Bug 1399220 (CVE-2016-9639)

Summary: CVE-2016-9639 salt: Vulnerable caching provides access to private pillar data
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: andrewniemants, ceph-eng-bugs, erik, herlo1, nthomas, sankarshan, sisharma
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: salt 2015.8.11 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-12-15 03:57:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1399223    
Bug Blocks: 1399225    

Description Andrej Nemec 2016-11-28 15:06:14 UTC 
Salt minions (clients), come with a descriptive id and a crypto key
each. Attaching a minion to a master (server) boils down to "accepting
its key" with a command on the master.

Now it can happen that after one minion is fully accepted, a second one
presents itself to the master with the same id but different key. In
that case, Salt will figure out that the key is different and reject the
second minion, assuming it is an impostor.

Due to Salt's caching mechanisms, I found out that under certain
circumstances Salt commands can reach, read data from and write data to,
both minions ("original" and "impostor"). That includes pillar data,
which is supposed to be secret to a certain minion.

References:

http://seclists.org/oss-sec/2016/q4/526
Comment 1 Andrej Nemec 2016-11-28 15:09:30 UTC 
Fedora 25, package salt, is not vulnerable because it currently has salt-2016.3.3-3.fc25 in stable
Comment 2 Andrej Nemec 2016-11-28 15:09:48 UTC 
Created salt tracking bugs for this issue:

Affects: epel-all [bug 1399223]