Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 12 Oct 2013 00:26:09 +0200
From: Michael Scherer <misc@...b.org>
To: oss-security@...ts.openwall.com
Subject: CVE request for saltstack minion identity usurpation

Hi,

While looking for saltstack issues on github, i stumbled on this pull
request :
https://github.com/saltstack/salt/pull/7356

It seems that saltstack, a client/server configuration system ( like
puppet, chef, cfengine ) allowed to have any minions ( agent on the
server to be configured ) to masquerade itself as any others agents when
requesting stuff from the master ( ie, main server ).
While I didn't fully check, this would permit a compromised server to
request data from another server, thus leading to potential informations
leak ( like passwword, etc ).

Can a CVE be assigned, and I will pass it to upstream on the bug
report ?

-- 
Michael Scherer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.