GitHub Advisoryadvisory · PyPI

GHSA-j6gj-pg62-x8j6 SaltStack Salt Directory traversal vulnerability in minion id validation

CRITICAL Published 2022-05-17 Modified 2024-10-21 Official page ↗
Aliases
CVE-2017-14695
Ecosystem
PyPI
Packages
salt
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-04-22

Affected packages

• PyPI salt: < 2016.3.8 → fixed in 2016.3.8 • PyPI salt: >= 2016.11.0, < 2016.11.8 → fixed in 2016.11.8 • PyPI salt: >= 2017.7.0, < 2017.7.2 → fixed in 2017.7.2

Description

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Related

Alias · CVE (1)

  • CVE-2017-14695 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References