GitHub Advisoryadvisory · PyPI

GHSA-xxvj-8g5m-4qgw SaltStack Salt Directory traversal vulnerability in minion id validation

CRITICAL Published 2022-05-17 Modified 2026-05-19 Official page ↗
Aliases
CVE-2017-12791
Ecosystem
PyPI
Packages
salt
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-04-22

Affected packages

• PyPI salt: < 2016.11.7 → fixed in 2016.11.7 • PyPI salt: >= 2017.7.0, < 2017.7.1 → fixed in 2017.7.1

Description

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

Related

Alias · CVE (1)

  • CVE-2017-12791 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References