CVE-2017-14695

CRITICAL9.8

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016

Published Oct 24, 2017

Modified 1 years ago

Details

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

References

ADVISORY

http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html

ADVISORY

http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=1500748

WEB

https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html

WEB

https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html

WEB