cve.bz

CVE-2023-34049

6.7 mediumEPSS 0.2%

Medium (6.7). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in salt 3005.4, 3006.4.

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

Severity

CVSS 3.1

6.7 medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS
0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4277-m35q-7c9wPyPIsalt<3005.43005.4
GHSA-4277-m35q-7c9wPyPIsalt>=3006.0rc1 <3006.43006.4
PYSEC-2026-1892PyPIsalt<3005.4
>=3006.0rc1 <3006.4
3005.4, 3006.4

References

Check your stackJSON