CVE-2023-20897

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-208987.8Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 300CVE-2023-208997.5VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the aCVE-2023-20908.8A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unCVE-2023-209007.5A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A95CVE-2023-209026.5A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below,  Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attackCVE-2023-209034.3This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity proCVE-2023-209047.8In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. ThiCVE-2023-209057.8In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to locCVE-2023-209067.8In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK updateCVE-2023-209085.5In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local deniaCVE-2023-209095.5In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. This could lead to loCVE-2023-20917.8A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function ad
CVE-2023-20897: Medium severity, CVSS 5.3 | Vulnix