{"id":"CVE-2023-34049","aliases":["EUVD-2024-3190","GHSA-4277-m35q-7c9w","PYSEC-2026-1892","SUSE-EL-9-CLIENT-TOOLS-2023-4757","SUSE-SU-2023:4386-1","SUSE-SU-2023:4387-1","SUSE-SU-2023:4388-1","SUSE-SU-2023:4389-1","SUSE-SU-2023:4390-1","SUSE-SU-2023:4412-1","SUSE-SU-2023:4748-1","SUSE-SU-2023:4749-1","SUSE-SU-2023:4757-1","UBUNTU-CVE-2023-34049","openSUSE-SU-2024:13630-1"],"status":"published","title":"Salt security advisory release - 2023-OCT-27","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00207,"percentile":0.10818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-340"],"published":"2023-11-09T02:33:02Z","modified":"2026-07-24T18:24:18Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["3005.4","3006.4"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","package":"venv-salt-minion","fixed_in":["3006.0-1.30.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"salt","fixed_in":["3006.0-150500.4.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"salt","fixed_in":["3006.0-150500.4.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"salt","fixed_in":["3006.0-150500.4.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP5","package":"salt","fixed_in":["3006.0-150500.4.24.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"salt","fixed_in":["3006.0-150500.4.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP4","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"salt","fixed_in":["3006.0-150400.8.49.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"salt","fixed_in":["3006.0-150300.53.65.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-simplejson","fixed_in":["3.17.2-150300.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"salt","fixed_in":["3006.0-150200.113.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"salt","fixed_in":["3006.0-150200.113.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"salt","fixed_in":["3006.0-150200.113.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"salt","fixed_in":["3006.0-150100.112.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"salt","fixed_in":["3006.0-150100.112.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"salt","fixed_in":["3006.0-150100.112.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","fixed_in":["4.3.9-150400.3.69.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","fixed_in":["4.3.9-150400.3.90.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"venv-salt-minion","fixed_in":["3006.0-3.46.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 15","package":"venv-salt-minion","fixed_in":["3006.0-150000.3.48.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"venv-salt-minion","fixed_in":["3006.0-150000.3.48.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"venv-salt-minion","fixed_in":["3006.0-150000.3.48.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"venv-salt-minion","fixed_in":["3006.0-150000.3.48.2"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundle-swig","fixed_in":["4.1.1-1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-appdirs","fixed_in":["1.4.4-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-certifi","fixed_in":["2018.1.18-1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-cffi","fixed_in":["1.15.1-1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-dateutil","fixed_in":["2.8.1-1.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-editables","fixed_in":["0.3-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-exceptiongroup","fixed_in":["1.1.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-exceptiongroup-test","fixed_in":["1.1.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-flit-core","fixed_in":["3.8.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-flit-scm","fixed_in":["1.7.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-hatch-vcs","fixed_in":["0.3.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-hatch-vcs-test","fixed_in":["0.3.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-hatchling","fixed_in":["1.13.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-iniconfig","fixed_in":["2.0.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-iniconfig-test","fixed_in":["2.0.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-lxml","fixed_in":["4.9.3-1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-more-itertools","fixed_in":["8.10.0-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-packaging","fixed_in":["23.1-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pathspec","fixed_in":["0.11.1-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pip","fixed_in":["20.2.4-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pluggy","fixed_in":["1.0.0-1.6.4"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pluggy-test","fixed_in":["1.0.0-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-py","fixed_in":["1.10.0-1.9.4"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pytest","fixed_in":["7.3.2-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-setuptools-scm","fixed_in":["7.1.0-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-tomli","fixed_in":["1.2.3-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-typing-extensions","fixed_in":["4.5.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-typing-extensions-test","fixed_in":["4.5.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-wheel","fixed_in":["0.40.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-wheel-test","fixed_in":["0.40.0-1.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"venv-salt-minion","fixed_in":["3006.0-1.30.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3005.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3006.0rc1"},{"fixed":"3006.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3005.4"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5","2019.2.6","2019.2.7","2019.2.8","3000","3000.0.0rc1","3000.0.0rc2","3000.1","3000.2","3000.3","3000.4","3000.5","3000.6","3000.7","3000.8","3000.9","3001","3001.1","3001.2","3001.3","3001.4","3001.5","3001.6","3001.7","3001.8","3001rc1","3002","3002.1","3002.2","3002.3","3002.4","3002.5","3002.6","3002.7","3002.8","3002.9","3002rc1","3003","3003.1","3003.2","3003.3","3003.4","3003.5","3003rc1","3004","3004.1","3004.2","3004rc1","3005","3005.1","3005.2","3005.3","3005rc1","3005rc2"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3006.0rc1"},{"fixed":"3006.4"}]}],"versions":["3006.0","3006.0rc1","3006.0rc2","3006.0rc3","3006.1","3006.2","3006.3"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3005.4"},{"introduced":"3006.0rc1"},{"fixed":"3006.4"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5","2019.2.6","2019.2.7","2019.2.8","3000","3000.0.0rc1","3000.0.0rc2","3000.1","3000.2","3000.3","3000.4","3000.5","3000.6","3000.7","3000.8","3000.9","3001","3001.1","3001.2","3001.3","3001.4","3001.5","3001.6","3001.7","3001.8","3001rc1","3002","3002.1","3002.2","3002.3","3002.4","3002.5","3002.6","3002.7","3002.8","3002.9","3002rc1","3003","3003.1","3003.2","3003.3","3003.4","3003.5","3003rc1","3004","3004.1","3004.2","3004rc1","3005","3005.1","3005.2","3005.3","3005rc1","3005rc2","3006.0","3006.0rc1","3006.0rc2","3006.0rc3","3006.1","3006.2","3006.3"]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.30.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.24.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.49.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.65.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-150300.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150200.113.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150200.113.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150200.113.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150100.112.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150100.112.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150100.112.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-150400.3.69.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-150400.3.90.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-3.46.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.48.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.48.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.48.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.48.2"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundle-swig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-appdirs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-certifi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.1.18-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-dateutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-flit-scm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3-1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-more-itertools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pathspec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pluggy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.6.4"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pluggy-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-1.9.4"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-pytest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.2-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-setuptools-scm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-tomli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-typing-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-typing-extensions-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-wheel-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.0-1.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.30.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.30.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1","0.17.5+ds-1ubuntu0.1~esm1","0.17.5+ds-1ubuntu0.1~esm2","0.17.5+ds-1ubuntu0.1~esm4","0.17.5+ds-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1","2015.8.8+ds-1ubuntu0.1+esm1","2015.8.8+ds-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1","2017.7.4+dfsg1-1ubuntu18.04.2","2017.7.4+dfsg1-1ubuntu18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3002.6+dfsg1-4","3002.7+dfsg1-1","3004+dfsg1-4","3004+dfsg1-5","3004+dfsg1-6ubuntu1","3004+dfsg1-7","3004+dfsg1-8","3004.1+dfsg-2"]}],"products":[{"vendor":"salt","product":"salt"},{"vendor":"salt project","product":"salt"},{"vendor":"salt_project","product":"salt"}],"references":[{"url":"https://saltproject.io/security-announcements/2023-10-27-advisory/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34049","tags":["advisory"]},{"url":"https://saltproject.io/security-announcements/2023-10-27-advisory","tags":["web"]},{"url":"https://github.com/saltstack/salt/commit/286d55eb5a6e6bf9428405bdf5632b419bdf8444","tags":["web"]},{"url":"https://github.com/saltstack/salt/commit/7a14112f2a16ce70e3c3e1862c92e37af5f2c7a4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4277-m35q-7c9w","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://pypi.org/project/salt","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement//suse-el-9-client-tools-2023-4757/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213351","tags":["report"]},{"url":"https://bugzilla.suse.com/1214477","tags":["report"]},{"url":"https://bugzilla.suse.com/1215157","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34049","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213293","tags":["report"]},{"url":"https://bugzilla.suse.com/1213518","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234387-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234388-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234389-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234390-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234412-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204270","tags":["report"]},{"url":"https://bugzilla.suse.com/1211047","tags":["report"]},{"url":"https://bugzilla.suse.com/1211145","tags":["report"]},{"url":"https://bugzilla.suse.com/1211270","tags":["report"]},{"url":"https://bugzilla.suse.com/1211912","tags":["report"]},{"url":"https://bugzilla.suse.com/1212168","tags":["report"]},{"url":"https://bugzilla.suse.com/1212507","tags":["report"]},{"url":"https://bugzilla.suse.com/1213132","tags":["report"]},{"url":"https://bugzilla.suse.com/1213376","tags":["report"]},{"url":"https://bugzilla.suse.com/1213469","tags":["report"]},{"url":"https://bugzilla.suse.com/1213680","tags":["report"]},{"url":"https://bugzilla.suse.com/1213689","tags":["report"]},{"url":"https://bugzilla.suse.com/1214041","tags":["report"]},{"url":"https://bugzilla.suse.com/1214121","tags":["report"]},{"url":"https://bugzilla.suse.com/1214463","tags":["report"]},{"url":"https://bugzilla.suse.com/1214553","tags":["report"]},{"url":"https://bugzilla.suse.com/1214746","tags":["report"]},{"url":"https://bugzilla.suse.com/1215027","tags":["report"]},{"url":"https://bugzilla.suse.com/1215120","tags":["report"]},{"url":"https://bugzilla.suse.com/1215412","tags":["report"]},{"url":"https://bugzilla.suse.com/1215514","tags":["report"]},{"url":"https://bugzilla.suse.com/1216661","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234748-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234749-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234757-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-34049","tags":["report"]},{"url":"https://saltproject.io/security-announcements/2023-10-27-advisory/index.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-34049","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-34049","title":"Salt security advisory release - 2023-OCT-27","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2024-11-14T04:13:55.255Z","modified":"2024-11-14T15:20:15.288Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:35.580545Z"}],"euvd":[{"id":"EUVD-2024-3190","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2024-11-14T04:13:55Z","modified":"2024-11-14T15:20:15Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:00.76838Z"}],"ghsa":[{"id":"GHSA-4277-m35q-7c9w","title":"Salt preflight script could be attacker controlled","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2024-11-14T06:30:45Z","modified":"2024-11-14T18:06:53Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-340"],"updated_at":"2026-11-02T14:38:19.029049Z"}],"nvd":[{"id":"CVE-2023-34049","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2024-11-14T05:15:28.26Z","modified":"2026-06-17T06:02:48.06Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"GHSA-4277-m35q-7c9w","title":"Salt preflight script could be attacker controlled","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2024-11-14T06:30:45Z","modified":"2026-07-07T17:57:27.070604061Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-340"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"PYSEC-2026-1892","title":"Salt preflight script could be attacker controlled","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2026-07-07T14:34:44.335132Z","modified":"2026-07-07T17:47:51.845406929Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2023-34049","description":"The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.","status":"published","published":"2024-11-14T05:15:00Z","modified":"2026-04-08T14:11:40.498073Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"openSUSE-SU-2024:13630-1","title":"python3-salt-3006.0-6.1 on GA media","description":"These are all security issues fixed in the python3-salt-3006.0-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:39.29344Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-EL-9-CLIENT-TOOLS-2023-4757","title":"Security update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n  * Security fixes:\n    * CVE-2023-34049: Arbitrary code execution via symlink attack (bsc#1215157)\n  * Non security fixes:\n    * Add python dateutil module to the bundle\n    * Allow all primitive grain types for autosign_grains (bsc#1214477)\n    * Remove non-free RNG schema file (bsc#1213351)\n","status":"published","published":"2023-12-13T09:33:43Z","modified":"2026-07-24T18:24:18.818434534Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2023:4386-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)\n\nBugs fixed:\n\n- Fix optimization_order opt to prevent testsuite fails\n- Improve salt.utils.json.find_json to avoid fails (bsc#1213293)\n- Use salt-call from salt bundle with transactional_update\n- Only call native_str on curl_debug message in tornado when needed\n- Implement the calling for batch async from the salt CLI\n- Fix calculation of SLS context vars when trailing dots\n  on targetted sls/state (bsc#1213518)\n- Rename salt-tests to python3-salt-testsuite\n- Allow all primitive grain types for autosign_grains (bsc#1214477)\n","status":"published","published":"2023-11-09T02:33:02Z","modified":"2026-02-04T02:22:08.858212Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4387-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)\n\nBugs fixed:\n\n- Fix optimization_order opt to prevent testsuite fails\n- Improve salt.utils.json.find_json to avoid fails (bsc#1213293)\n- Use salt-call from salt bundle with transactional_update\n- Only call native_str on curl_debug message in tornado when needed\n- Implement the calling for batch async from the salt CLI\n- Fix calculation of SLS context vars when trailing dots\n  on targetted sls/state (bsc#1213518)\n- Rename salt-tests to python3-salt-testsuite\n- Allow all primitive grain types for autosign_grains (bsc#1214477)\n","status":"published","published":"2023-11-09T02:33:58Z","modified":"2026-02-04T02:31:45.237236Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4388-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)\n\nBugs fixed:\n\n- Fix optimization_order opt to prevent testsuite fails\n- Improve salt.utils.json.find_json to avoid fails (bsc#1213293)\n- Use salt-call from salt bundle with transactional_update\n- Only call native_str on curl_debug message in tornado when needed\n- Implement the calling for batch async from the salt CLI\n- Fix calculation of SLS context vars when trailing dots\n  on targetted sls/state (bsc#1213518)\n- Rename salt-tests to python3-salt-testsuite\n- Allow all primitive grain types for autosign_grains (bsc#1214477)\n","status":"published","published":"2023-11-09T02:36:03Z","modified":"2025-05-02T04:35:03.027946Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4389-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)\n\nBugs fixed:\n\n- Fix optimization_order opt to prevent testsuite fails\n- Improve salt.utils.json.find_json to avoid fails (bsc#1213293)\n- Use salt-call from salt bundle with transactional_update\n- Only call native_str on curl_debug message in tornado when needed\n- Implement the calling for batch async from the salt CLI\n- Fix calculation of SLS context vars when trailing dots\n  on targetted sls/state (bsc#1213518)\n- Rename salt-tests to python3-salt-testsuite\n- Allow all primitive grain types for autosign_grains (bsc#1214477)\n","status":"published","published":"2023-11-09T02:37:01Z","modified":"2026-02-04T04:25:57.480743Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4390-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)\n\nBugs fixed:\n\n- Fix optimization_order opt to prevent testsuite fails\n- Improve salt.utils.json.find_json to avoid fails (bsc#1213293)\n- Use salt-call from salt bundle with transactional_update\n- Only call native_str on curl_debug message in tornado when needed\n- Implement the calling for batch async from the salt CLI\n- Fix calculation of SLS context vars when trailing dots\n  on targetted sls/state (bsc#1213518)\n- Rename salt-tests to python3-salt-testsuite\n- CVE-2023-34049: arbitrary code execution via symlink attack (bsc#1215157)\n- Allow all primitive grain types for autosign_grains (bsc#1214477)\n","status":"published","published":"2023-11-09T02:37:25Z","modified":"2026-02-04T02:45:23.097877Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4412-1","title":"Security update for SUSE Manager Server 4.3","description":"\nThis update fixes the following issues:\n\n- Update to SUSE Manager 4.3.9\n  * Debian 12 support as client\n  * New Update Notification (jsc#SUMA-111)\n  * Monitoring: Grafana upgraded to 9.5.8\n  * Update 'saltkey' endpoints to accept GET instead of POST\n  * CVEs fixed:\n    CVE-2023-34049\n  * Bugs mentioned:\n    bsc#1204270, bsc#1211047, bsc#1211145, bsc#1211270, bsc#1211912\n    bsc#1212168, bsc#1212507, bsc#1213132, bsc#1213376, bsc#1213469\n    bsc#1213680, bsc#1213689, bsc#1214041, bsc#1214121, bsc#1214463\n    bsc#1214553, bsc#1214746, bsc#1215027, bsc#1215120, bsc#1215412\n    bsc#1215514, bsc#1216661, bsc#1215157\n    \n","status":"published","published":"2023-11-09T02:50:01Z","modified":"2026-02-04T02:44:09.290729Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4748-1","title":"Security update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n  * Security fixes:\n    * CVE-2023-34049: Arbitrary code execution via symlink attack (bsc#1215157)\n  * Non security fixes:\n    * Add python dateutil module to the bundle\n    * Allow all primitive grain types for autosign_grains (bsc#1214477)\n    * Remove non-free RNG schema file (bsc#1213351)\n","status":"published","published":"2023-12-13T09:24:14Z","modified":"2026-02-04T03:06:04.219721Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4749-1","title":"Security update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n  * Security fixes:\n    * CVE-2023-34049: Arbitrary code execution via symlink attack (bsc#1215157)\n  * Non security fixes:\n    * Add python dateutil module to the bundle\n    * Allow all primitive grain types for autosign_grains (bsc#1214477)\n    * Remove non-free RNG schema file (bsc#1213351)\n","status":"published","published":"2023-12-13T09:26:13Z","modified":"2026-02-04T03:10:36.530635Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4757-1","title":"Security update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n  * Security fixes:\n    * CVE-2023-34049: Arbitrary code execution via symlink attack (bsc#1215157)\n  * Non security fixes:\n    * Add python dateutil module to the bundle\n    * Allow all primitive grain types for autosign_grains (bsc#1214477)\n    * Remove non-free RNG schema file (bsc#1213351)\n","status":"published","published":"2023-12-13T09:33:43Z","modified":"2026-02-04T04:35:25.952664Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}