[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1381530369.13764.484.camel@liliana.cdg.redhat.com>
Date: Sat, 12 Oct 2013 00:26:09 +0200
From: Michael Scherer <misc@...b.org>
To: oss-security@...ts.openwall.com
Subject: CVE request for saltstack minion identity usurpation
Hi,
While looking for saltstack issues on github, i stumbled on this pull
request :
https://github.com/saltstack/salt/pull/7356
It seems that saltstack, a client/server configuration system ( like
puppet, chef, cfengine ) allowed to have any minions ( agent on the
server to be configured ) to masquerade itself as any others agents when
requesting stuff from the master ( ie, main server ).
While I didn't fully check, this would permit a compromised server to
request data from another server, thus leading to potential informations
leak ( like passwword, etc ).
Can a CVE be assigned, and I will pass it to upstream on the bug
report ?
--
Michael Scherer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
