Denial of Service Issue in Salt Master by Salt Project
CVE-2023-20897

5.3MEDIUM

Key Information:

Vendor

Saltstack

Status
Salt
Vendor
CVE Published:
5 September 2023

What is CVE-2023-20897?

Salt masters prior to versions 3005.2 and 3006.2 are susceptible to a denial of service vulnerability. When the request server receives multiple malformed packets, equal to the number of worker threads, it can lead to the master becoming unresponsive to return requests. This condition persists until the master is manually restarted, disrupting normal operational capabilities.

Affected Version(s)

Salt Salt masters prior to 3005.2 or 3006.2

References

https://saltproject.io/security-announcements/2023-08-10-...
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.