-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | >= 2016.11, < 2016.11.4 | 2016.11.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) In fileclient.py, the get_file function explicitly copied permissions from the master's files (via fnd_mode/mode_server) to minion cache files using os.chmod, without sanitization. 2) In file.py, manage_file used local cached file permissions (from insecure cache) rather than querying the master's intended permissions. The fix removed permission mirroring in fileclient.py and introduced cp.stat_file to retrieve correct permissions from the master. The commit diff shows removal of os.chmod operations and replacement of os.stat with cp.stat_file, confirming these were the vulnerable code paths.
PythonPythonOngoing coverage of React2Shell