Salt Master Arbitrary Event Injection Vulnerability

A vulnerability exists in Salt Master versions through 3006.12 and in 3007.0 and later, allowing authorized minions to inject arbitrary events into the master's event bus. This is possible because the master's '_minion_event' method can be exploited by minions with access to a minion key.

Impact

Exploitation of this vulnerability allows for unauthorized event injection on the master's event bus, which could be used to disrupt normal operations or manipulate event-driven processes.