SaltStack Worker Process Denial-of-Service Vulnerability via Unvalidated File Read Operation

A denial-of-service vulnerability has been identified in SaltStack's Master component, specifically within the 'pub_ret' method. This issue arises because the 'jid' input value is not properly sanitized before being used to construct a file path for reading operations. An attacker could exploit this vulnerability by targeting filenames that are unlikely to return data, such as pipe nodes in the proc file system.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition on the Salt Master by causing the worker process to hang or become unresponsive while attempting to read from the targeted file.