Input validation error in Salt - CVE-2023-20897

Vulnerability identifier: #VU80471

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20897

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted packets to port 4506 and perform a denial of service (DoS) attack.

Salt
Gentoo Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server Module
SUSE Manager Proxy Module
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Fedora
SUSE Manager Client Tools for RHEL, Liberty and Clones
SUSE Manager Client Tools for Debian
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
Server Applications Module
Transactional Server Module
Basesystem Module
openSUSE Leap
scap-security-guide-debian
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
salt
salt-common
salt-minion
venv-salt-minion
salt-zsh-completion
salt-bash-completion
salt-fish-completion
salt-ssh
salt-master
salt-cloud
salt-doc
salt-syndic
salt-transactional-update
salt-standalone-formulas-configuration
salt-api
salt-proxy
python3-salt
salt-tests
app-admin/salt
Dell EMC VxRail Appliance

Install updates from vendor's website.

Salt - addressed in versions 3005.2, 3006.2
scap-security-guide-debian - update to 0.1.69-2.35.1
release-notes-susemanager-proxy - update to 4.3.8-150400.3.61.2
release-notes-susemanager - update to 4.3.8-150400.3.77.1
spacecmd - update to 4.3.23-2.54.1
Dell EMC VxRail Appliance - update to 8.0.120
salt - addressed in versions 3005.2-1.el9, 3005.2-1.fc37
salt-common - update to 3006.0+ds-1+2.88.1
salt-minion - addressed in versions 3006.0+ds-1+2.88.1, 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
venv-salt-minion - addressed in versions 3006.0-1.24.1, 3006.0-2.38.1, 3006.0-2.40.1, 3006.0-3.40.1, 3006.0-150000.3.42.1
salt-zsh-completion - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-bash-completion - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-fish-completion - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-ssh - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-master - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-cloud - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-doc - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-syndic - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-transactional-update - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-standalone-formulas-configuration - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-api - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-proxy - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
python3-salt - addressed in versions 3006.0-150100.107.1, 3006.0-150200.108.1, 3006.0-150300.53.60.1, 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
salt-tests - addressed in versions 3006.0-150400.8.44.1, 3006.0-150500.4.19.1
app-admin/salt - update to 3006.6

• https://saltproject.io/security-announcements/2023-08-10-advisory/

• Multiple vulnerabilities in Salt
• Fedora 37 update for salt
• Fedora EPEL 9 update for salt
• SUSE update for Maintenance update for SUSE Manager 4.3.8 Release Notes
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Gentoo update for Salt