CVE-2023-20897

unknown

Published 2023-09-05 · Modified 2023-11-08

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v2

—

VIR risk

—

Description

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2023-20897.html

OS impact

OS	Version	Status	Fixed in
sles		affected

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	salt	`<3005.2`	`3005.2`
PyPI	salt	`>=3006.0rc1,<3006.2`	`3006.2`

References

https://nvd.nist.gov/vuln/detail/CVE-2023-20897
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml
https://github.com/saltstack/salt
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL
https://saltproject.io/security-announcements/2023-08-10-advisory
https://saltproject.io/security-announcements/2023-08-10-advisory/
https://www.suse.com/security/cve/CVE-2023-20897.html

Verify integrity in audit chain (admin only). AS-IS.