CVE-2023-34049 Salt security advisory release - 2023-OCT-27

What is CVE-2023-34049?

CVE-2023-34049 is a medium-severity path traversal vulnerability in SALT, published on 14 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

Which versions are affected by CVE-2023-34049?

5 open source packages ship an affected version, including salt.

How do I fix CVE-2023-34049?

Upgrade salt to a fixed version for your release line: 3005.4 or 3006.4.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-34049 being exploited?

There is no known exploitation of CVE-2023-34049 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4277-m35q-7c9w, PYSEC-2026-1892, SUSE-EL-9-CLIENT-TOOLS-2023-4757, SUSE-SU-2023:4386-1, SUSE-SU-2023:4387-1, SUSE-SU-2023:4388-1 and 8 more.