{"id":"CVE-2017-12791","aliases":["EUVD-2017-0119","GHSA-xxvj-8g5m-4qgw","PYSEC-2017-151","PYSEC-2017-35","SUSE-SU-2017:2666-1","SUSE-SU-2017:2674-1","SUSE-SU-2017:2676-1","UBUNTU-CVE-2017-12791","USN-4769-1","openSUSE-SU-2024:11364-1"],"status":"published","title":"SaltStack Salt Directory traversal vulnerability in minion id validation","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04667,"percentile":0.91817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2017-08-23T14:00:00Z","modified":"2026-10-20T10:48:09Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2016.11.7","2017.7.1"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","fixed_in":["2016.11.4-43.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","fixed_in":["2016.11.4-43.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"salt","fixed_in":["2016.11.4-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.1","package":"salt","fixed_in":["2016.11.4-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.0","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 3","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"salt","fixed_in":["2016.11.4-46.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","fixed_in":["0.17.5+ds-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","fixed_in":["2015.8.8+ds-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.7"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.7.0"},{"fixed":"2017.7.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.7"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.7.0"},{"fixed":"2017.7.1"}]}],"versions":["2017.7.0"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.7"},{"introduced":"2017.7"},{"fixed":"2017.7.1"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-43.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-43.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.5+ds-1ubuntu0.1~esm1"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1+esm1"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.5+ds-1ubuntu0.1~esm1"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1+esm1"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1"],"bundled":8}],"products":[{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://github.com/saltstack/salt/pull/42944","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.securityfocus.com/bid/100384","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482006","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Release Notes","Vendor Advisory","fix","web"]},{"url":"https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Release Notes","Vendor Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12791","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-35.yaml","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-151.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xxvj-8g5m-4qgw","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172666-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1051948","tags":["report"]},{"url":"https://bugzilla.suse.com/1052264","tags":["report"]},{"url":"https://bugzilla.suse.com/1053376","tags":["report"]},{"url":"https://bugzilla.suse.com/1053955","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12791","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172674-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036125","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172676-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-12791","tags":["report"]},{"url":"https://github.com/saltstack/salt/commit/6366e05d0d70bd709cc4233c3faf32a759d0173a","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12791","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4769-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15751","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31607","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-12791","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2017-08-23T14:00:00Z","modified":"2024-08-05T18:51:07.262Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-0119","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2017-08-23T14:00:00Z","modified":"2024-08-05T18:51:07Z","updated_at":"2026-11-03T02:23:20.155596Z"}],"ghsa":[{"id":"GHSA-xxvj-8g5m-4qgw","title":"SaltStack Salt Directory traversal vulnerability in minion id validation","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2022-05-17T01:22:50Z","modified":"2026-05-19T20:24:53Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"nvd":[{"id":"CVE-2017-12791","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2017-08-23T14:29:00.283Z","modified":"2026-06-17T01:03:56.573Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-12791","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2017-08-23T14:29:00.283Z","modified":"2026-10-20T10:48:09.743158033Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"GHSA-xxvj-8g5m-4qgw","title":"SaltStack Salt Directory traversal vulnerability in minion id validation","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2022-05-17T01:22:50Z","modified":"2026-07-09T16:56:24.190827719Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"PYSEC-2017-151","description":"Withdrawn as duplicate of PYSEC-2017-35 Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"withdrawn","published":"2017-08-23T14:29:00.283Z","modified":"2026-07-09T16:45:09.476844468Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2017-12791","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2017-08-23T14:29:00Z","modified":"2026-02-04T02:19:19.139143Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"openSUSE-SU-2024:11364-1","title":"python3-salt-3002.2-6.1 on GA media","description":"These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:00.752468Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"PYSEC-2017-35","description":"Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.","status":"published","published":"2017-08-23T14:29:00Z","modified":"2026-07-09T16:56:24.190827719Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2017:2666-1","title":"Security update for salt","description":"This update for salt fixes one security issue and bugs.\n\nThe following security issue has been fixed:\n\n- CVE-2017-12791: Directory traversal vulnerability in minion id validation\n  allowed remote minions with incorrect credentials to authenticate to a master\n  via a crafted minion ID (bsc#1053955).\n\nAdditionally, the following non-security issues have been fixed:\n\n- Added support for SUSE Manager scalability features. (bsc#1052264)\n- Introduced the kubernetes module. (bsc#1051948)\n- Notify systemd synchronously via NOTIFY_SOCKET. (bsc#1053376)\n","status":"published","published":"2017-10-09T13:38:05Z","modified":"2026-02-04T04:38:45.393261Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2674-1","title":"Security update for Salt","description":"This update for salt fixes one security issue and bugs:\n\nThe following security issue has been fixed:\n\n- CVE-2017-12791: Directory traversal vulnerability in minion id validation\n  allowed remote minions with incorrect credentials to authenticate to a master\n  via a crafted minion ID (bsc#1053955).\n\nAdditionally, the following non-security issues have been fixed:\n\n- Added support for SUSE Manager scalability features. (bsc#1052264)\n- Introduced the kubernetes module. (bsc#1051948)\n- Notify systemd synchronously via NOTIFY_SOCKET. (bsc#1053376)\n- Added bugfix when jobs scheduled to run at a future time stay pending for Salt minions. (bsc#1036125)\n- Adding procps as dependency. This provides 'ps' and 'pgrep' utils which are called from different Salt\n  modules and also from new salt-minion watchdog.","status":"published","published":"2017-10-09T13:38:11Z","modified":"2026-02-04T04:17:27.78403Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2676-1","title":"Security update for Salt","description":"This update for salt fixes one security issue and bugs:\n\nThe following security issue has been fixed:\n\n- CVE-2017-12791: Directory traversal vulnerability in minion id validation\n  allowed remote minions with incorrect credentials to authenticate to a master\n  via a crafted minion ID (bsc#1053955).\n\nAdditionally, the following non-security issues have been fixed:\n\n- Added support for SUSE Manager scalability features. (bsc#1052264)\n- Introduced the kubernetes module. (bsc#1051948)\n- Notify systemd synchronously via NOTIFY_SOCKET. (bsc#1053376)","status":"published","published":"2017-10-09T13:39:39Z","modified":"2026-02-04T04:12:23.266518Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-4769-1","title":"salt vulnerabilities","description":"It was discovered that Salt allowed remote attackers to write to\narbitrary files via a special crafted file. An attacker could use this\nvulnerability to cause a DoS or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 ESM. (CVE-2014-3563)\n\nAndreas Stieger discovered that Salt exposed git usernames and passwords\nin log files. An attacker could use this issue to retrieve sensitive\ninformation. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6918).\n\nIt was discovered that Salt exposed password authentication\ncredentials in log files. An attacker could use this issue to retrieve\nsensitive information. This issue only affected Ubuntu 14.04 ESM.\n(CVE-2015-6941)\n\nIt was discovered that Salt allowed remote attackers to write to\narbitrary files via a special crafted file. An attacker could use this \nissue to cause a DoS or possibly execute arbitrary code. (CVE-2017-12791,\nCVE-2017-14695, CVE-2017-14696)\n\nIt was discovered that Salt allowed remote attackers to determine which\nfiles exist on the server. An attacker could use this issue to extract\nsensitive information. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-15750)\n\nIt was discovered that Salt allowed users to bypass authentication. An\nattacker could use this issue to extract sensitive information, execute\narbitrary code or crash the server. This issue only affected Ubuntu 16.04\nESM. (CVE-2018-15751)","status":"published","published":"2021-03-15T20:11:16Z","modified":"2026-06-29T13:48:13.302310265Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}