CRITICAL
salt: Directory traversal in minion id validation
Published Oct 24, 2017
9.8
CRITICALCVSS 3.0
EPSS 2.59%
Description
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Affected products
No data.
OR
- ≤ 2016.3.7
- 2016.11
- 2016.11.0
- 2016.11.1
- 2016.11.1
- 2016.11.1
- 2016.11.2
- 2016.11.3
- 2016.11.4
- 2016.11.5
- 2016.11.6
- 2016.11.7
- 2017.7.0
- 2017.7.0
- 2017.7.1
No data.
Red Hat Ceph Storage 1.3
salt
Will not fix
Red Hat Ceph Storage 2
salt
Will not fix
Red Hat Storage Console 2
salt
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 1.3 | salt | Will not fix | n/a |
| Red Hat Ceph Storage 2 | salt | Will not fix | n/a |
| Red Hat Storage Console 2 | salt | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (13)
- http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html vendor-advisoryx_refsource_SUSEIssue TrackingRelease NotesThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html vendor-advisoryx_refsource_SUSEIssue TrackingRelease NotesThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-14695 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1500748 x_refsource_CONFIRMIssue TrackingRelease NotesThird Party Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html x_refsource_CONFIRMIssue TrackingRelease NotesVendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html x_refsource_CONFIRMIssue TrackingRelease NotesVendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html x_refsource_CONFIRMIssue TrackingRelease NotesVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0120 Advisory
- https://github.com/advisories/GHSA-j6gj-pg62-x8j6 Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-36.yaml
- https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2017-14695
- https://www.cve.org/CVERecord?id=CVE-2017-14695
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 24, 2017
Updated Aug 5, 2024
Reserved Sep 22, 2017
Link CVE-2017-14695
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2017-0120 GHSA-J6GJ-PG62-X8J6 Assigner mitre
Published Oct 24, 2017
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2017-0120