CVE-2015-4017

Description

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.

How to fix CVE-2015-4017

To remediate CVE-2015-4017, upgrade the affected package to a fixed version below.

• PyPI/salt—upgrade to 2014.7.6 or later
• PyPI/salt—upgrade to 2014.7.6 or later

Is CVE-2015-4017 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2014.7.6
• from 0, < 2014.7.6

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-8j9g-c9rp-jvg4
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-4017
• PATCHgithub.com/saltstack/salt
• WEBbugzilla.redhat.com/show_bug.cgi?id=1222960
• WEB