-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper AES key rotation when minions are deleted. The 'rotate_aes_key' parameter introduced in 2015.8.11 explicitly addresses this by forcing key rotation on deletion. The key deletion logic (salt.key.Key.delete_key) likely lacked this rotation in vulnerable versions, and the master's ACL/caching system (salt.master.Master.__load_acl) failed to purge old sessions. This allowed deleted minions to reuse cached keys. While exact code changes aren't provided, the documented fix and CWE-284 (Improper Access Control) strongly implicate these core key management functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2015.8.11 | 2015.8.11 |
PythonPythonOngoing coverage of React2Shell