Vulnerability Details : CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
Vulnerability category: Denial of service
Products affected by CVE-2023-20897
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-20897
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-20897
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
3.9
|
1.4
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
3.9
|
1.4
|
VMware |
CWE ids for CVE-2023-20897
-
The product does not release or incorrectly releases a resource before it is made available for re-use.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-20897
-
https://saltproject.io/security-announcements/2023-08-10-advisory/
Saltproject.io - Salt security advisory release - 2023-AUG-10Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL/
[SECURITY] Fedora 37 Update: salt-3005.2-1.fc37 - package-announce - Fedora Mailing-Lists
Jump to