{"id":"CVE-2017-14696","aliases":["EUVD-2017-0121","GHSA-657p-cj5r-mjrh","PYSEC-2017-37","SUSE-SU-2017:3380-1","SUSE-SU-2017:3381-1","SUSE-SU-2018:1757-1","SUSE-SU-2018:3811-1","UBUNTU-CVE-2017-14696","USN-4769-1","openSUSE-SU-2024:11364-1"],"status":"published","title":"SaltStack Salt Denial of Service via a crafted authentication request","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03769,"percentile":0.89992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400"],"published":"2017-10-24T17:00:00Z","modified":"2026-10-20T10:47:49Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2016.3.8","2016.11.8","2017.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","fixed_in":["0.17.5+ds-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","fixed_in":["2015.8.8+ds-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.3.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"fixed":"2016.11.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.7.0"},{"fixed":"2017.7.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.3.8"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2016.11.0"},{"fixed":"2016.11.8"}]}],"versions":["2016.11.0","2016.11.1","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.7.0"},{"fixed":"2017.7.2"}]}],"versions":["2017.7.0","2017.7.1"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.3.8"},{"introduced":"2016.11"},{"fixed":"2016.11.8"},{"introduced":"2017.7"},{"fixed":"2017.7.2"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.1","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2017.7.0","2017.7.1","v2017.7","v2017.5","v2017.7.0","v2017.7.0rc1","v2016.9","v2016.11","v2016.3","v2015.8","v2015.5","v2015.2","v2014.7","v2014.1","v0.17","v0.16","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.9","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.9","v0.8.7","v0.8.0","v0.7.0","v0.6.0"]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-46.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-43.10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-43.10.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.0-46.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"apache-mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"hadoop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"icu4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"55.1-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"lucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"nekohtml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.21-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"nutch-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"picocontainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-1.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-0.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.8.13-2.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.6-2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.73.15-2.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2.15-2.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.4-2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.46.17-2.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3.6-2.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.10.9-2.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1.19-2.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-2.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-branding-oss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.20-2.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.19-2.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-2.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"tagsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-1.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.5+ds-1ubuntu0.1~esm1"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1+esm1"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.5+ds-1ubuntu0.1~esm1"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1+esm1"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1"],"bundled":8}],"products":[{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Vendor Advisory","report","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Issue Tracking","Release Notes","Third Party Advisory","report","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Issue Tracking","Release Notes","Third Party Advisory","report","web"]},{"url":"https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Vendor Advisory","report","web"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Vendor Advisory","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500742","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Release Notes","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14696","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-37.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-657p-cj5r-mjrh","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173380-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1041993","tags":["report"]},{"url":"https://bugzilla.suse.com/1042749","tags":["report"]},{"url":"https://bugzilla.suse.com/1050003","tags":["report"]},{"url":"https://bugzilla.suse.com/1059291","tags":["report"]},{"url":"https://bugzilla.suse.com/1059758","tags":["report"]},{"url":"https://bugzilla.suse.com/1060230","tags":["report"]},{"url":"https://bugzilla.suse.com/1062462","tags":["report"]},{"url":"https://bugzilla.suse.com/1062464","tags":["report"]},{"url":"https://bugzilla.suse.com/985112","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14696","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173381-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1061407","tags":["report"]},{"url":"https://bugzilla.suse.com/1064520","tags":["report"]},{"url":"https://bugzilla.suse.com/1075950","tags":["report"]},{"url":"https://bugzilla.suse.com/1079048","tags":["report"]},{"url":"https://bugzilla.suse.com/1081592","tags":["report"]},{"url":"https://bugzilla.suse.com/1087055","tags":["report"]},{"url":"https://bugzilla.suse.com/1087278","tags":["report"]},{"url":"https://bugzilla.suse.com/1087581","tags":["report"]},{"url":"https://bugzilla.suse.com/1087891","tags":["report"]},{"url":"https://bugzilla.suse.com/1088888","tags":["report"]},{"url":"https://bugzilla.suse.com/1089112","tags":["report"]},{"url":"https://bugzilla.suse.com/1089362","tags":["report"]},{"url":"https://bugzilla.suse.com/1089526","tags":["report"]},{"url":"https://bugzilla.suse.com/1090242","tags":["report"]},{"url":"https://bugzilla.suse.com/1091371","tags":["report"]},{"url":"https://bugzilla.suse.com/1092161","tags":["report"]},{"url":"https://bugzilla.suse.com/1092373","tags":["report"]},{"url":"https://bugzilla.suse.com/1094055","tags":["report"]},{"url":"https://bugzilla.suse.com/1097174","tags":["report"]},{"url":"https://bugzilla.suse.com/1097413","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183811-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034030","tags":["report"]},{"url":"https://bugzilla.suse.com/1037389","tags":["report"]},{"url":"https://bugzilla.suse.com/1042184","tags":["report"]},{"url":"https://bugzilla.suse.com/1080474","tags":["report"]},{"url":"https://bugzilla.suse.com/1090676","tags":["report"]},{"url":"https://bugzilla.suse.com/1094524","tags":["report"]},{"url":"https://bugzilla.suse.com/1094992","tags":["report"]},{"url":"https://bugzilla.suse.com/1095220","tags":["report"]},{"url":"https://bugzilla.suse.com/1095942","tags":["report"]},{"url":"https://bugzilla.suse.com/1095972","tags":["report"]},{"url":"https://bugzilla.suse.com/1096511","tags":["report"]},{"url":"https://bugzilla.suse.com/1098970","tags":["report"]},{"url":"https://bugzilla.suse.com/1099857","tags":["report"]},{"url":"https://bugzilla.suse.com/1100852","tags":["report"]},{"url":"https://bugzilla.suse.com/1101033","tags":["report"]},{"url":"https://bugzilla.suse.com/1104120","tags":["report"]},{"url":"https://bugzilla.suse.com/1104487","tags":["report"]},{"url":"https://bugzilla.suse.com/1105045","tags":["report"]},{"url":"https://bugzilla.suse.com/1105074","tags":["report"]},{"url":"https://bugzilla.suse.com/1105720","tags":["report"]},{"url":"https://bugzilla.suse.com/1105724","tags":["report"]},{"url":"https://bugzilla.suse.com/1105886","tags":["report"]},{"url":"https://bugzilla.suse.com/1106164","tags":["report"]},{"url":"https://bugzilla.suse.com/1106875","tags":["report"]},{"url":"https://bugzilla.suse.com/1107117","tags":["report"]},{"url":"https://bugzilla.suse.com/1107302","tags":["report"]},{"url":"https://bugzilla.suse.com/1107850","tags":["report"]},{"url":"https://bugzilla.suse.com/1107869","tags":["report"]},{"url":"https://bugzilla.suse.com/1109235","tags":["report"]},{"url":"https://bugzilla.suse.com/1111249","tags":["report"]},{"url":"https://bugzilla.suse.com/1111542","tags":["report"]},{"url":"https://bugzilla.suse.com/1112163","tags":["report"]},{"url":"https://bugzilla.suse.com/1113557","tags":["report"]},{"url":"https://bugzilla.suse.com/1113698","tags":["report"]},{"url":"https://bugzilla.suse.com/1113699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14696","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4769-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15751","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31607","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-14696","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2017-10-24T17:00:00Z","modified":"2024-08-05T19:34:39.957Z","updated_at":"2026-11-02T14:33:12.267141Z"}],"euvd":[{"id":"EUVD-2017-0121","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2017-10-24T17:00:00Z","modified":"2024-08-05T19:34:39Z","updated_at":"2026-11-03T02:23:16.177631Z"}],"ghsa":[{"id":"GHSA-657p-cj5r-mjrh","title":"SaltStack Salt Denial of Service via a crafted authentication request","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2022-05-17T00:23:46Z","modified":"2024-10-22T14:55:39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2017-14696","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2017-10-24T17:29:00.37Z","modified":"2026-06-17T01:06:36.783Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"CVE-2017-14696","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2017-10-24T17:29:00.37Z","modified":"2026-10-20T10:47:49.700437474Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"GHSA-657p-cj5r-mjrh","title":"SaltStack Salt Denial of Service via a crafted authentication request","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2022-05-17T00:23:46Z","modified":"2024-10-22T15:12:06.919892Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2017-14696","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2017-10-24T17:29:00Z","modified":"2026-02-04T03:35:15.328464Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"openSUSE-SU-2024:11364-1","title":"python3-salt-3002.2-6.1 on GA media","description":"These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:00.752468Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"PYSEC-2017-37","description":"SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.","status":"published","published":"2017-10-24T17:29:00Z","modified":"2026-06-10T17:02:50.029565667Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2017:3380-1","title":"Security update for Salt","description":"This update for salt fixes one security issue and bugs.\n\nThe following security issues have been fixed:\n\n- CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect\n  credentials to authenticate to a master via a crafted minion ID. (bsc#1062462)\n- CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication \n  request. (bsc#1062464)\n\nAdditionally, the following non-security issues have been fixed:\n\n- Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993)\n- Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230)\n- Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758)\n- Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112)\n- Fix for delete_deployment in Kubernetes module. (bsc#1059291)\n- Catching error when PIDfile cannot be deleted. (bsc#1050003)\n- Use $HOME to get the user home directory instead using '~' char. (bsc#1042749)\n","status":"published","published":"2017-12-20T11:13:24Z","modified":"2026-02-04T02:26:51.346005Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2017:3381-1","title":"Security update for Salt","description":"This update for salt fixes one security issue and bugs.\n\nThe following security issues have been fixed:\n\n- CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect\n  credentials to authenticate to a master via a crafted minion ID. (bsc#1062462)\n- CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication \n  request. (bsc#1062464)\n\nAdditionally, the following non-security issues have been fixed:\n\n- Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993)\n- Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230)\n- Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758)\n- Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112)\n- Fix for delete_deployment in Kubernetes module. (bsc#1059291)\n- Catching error when PIDfile cannot be deleted. (bsc#1050003)\n- Use $HOME to get the user home directory instead using '~' char. (bsc#1042749)\n","status":"published","published":"2017-12-20T11:22:47Z","modified":"2026-02-04T03:37:01.627924Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1757-1","title":"Security update for salt","description":"This update for salt provides version 2018.3 and brings many fixes and improvements:\n\n- Fix for sorting of multi-version packages (bsc#1097174 and bsc#1097413)\n- Align SUSE salt-master.service 'LimitNOFILES' limit with upstream Salt\n- Add 'other' attribute to GECOS fields to avoid inconsistencies with chfn\n- Prevent zypper from parsing repo configuration from  not .repo files (bsc#1094055)\n- Collect all versions of installed packages on SUSE and RHEL  systems (bsc#1089526)\n- No more AWS EC2 rate limitations in salt-cloud. (bsc#1088888)\n- MySQL returner now also allows to use Unix sockets. (bsc#1091371)\n- Do not override jid on returners, only sending back to master. (bsc#1092373)\n- Remove minion/thin/version if exists to force thin regeneration. (bsc#1092161)\n- Fix minion scheduler to return a 'retcode' attribute. (bsc#1089112)\n- Fix for logging during network interface querying. (bsc#1087581)\n- Fix rhel packages requires both net-tools and iproute. (bsc#1087055)\n- Fix patchinstall on yum module. Bad comparison. (bsc#1087278)\n- Strip trailing commas on Linux user's GECOS fields. (bsc#1089362)\n- Fallback to PyMySQL. (bsc#1087891)\n- Fix for [Errno 0] Resolver Error 0 (no error). (bsc#1087581)\n- Add python-2.6 support to salt-ssh.\n- Make it possible to use docker login, pull and push from module.run and detect errors.\n- Fix unicode decode error with salt-ssh.\n- Fix cp.push empty file. (bsc#1075950)\n- Fix grains containing trailing '\\n'.\n- Remove salt-minion python2 requirement when python3 is default. (bsc#1081592)\n- Restoring installation of packages for Rhel 6 and 7.\n- Prevent queryformat pattern from expanding. (bsc#1079048)\n- Fix for delete_deployment in Kubernetes module. (bsc#1059291)\n- Fix bsc#1062464 and CVE-2017-14696 already included in 2017.7.2.\n- Fix wrong version reported by Salt. (bsc#1061407)\n- Run salt-api as user salt. (bsc#1064520)\n\nFor a detailed description, please refer to the upstream-changelog at \nhttps://docs.saltstack.com/en/latest/topics/releases/index.html or to the\nrpm-changelog.\n\nsupportutils-plugin-salt:\n\n- Collect salt-api, salt-broker and salt-ssh log files (bsc#1090242)\n ","status":"published","published":"2018-06-19T13:32:11Z","modified":"2026-02-04T03:10:38.838237Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:3811-1","title":"Security update for SUSE Manager Server 3.1","description":"\nThis update includes the following new features:\n\n- Add support for postgresql 10 (fate#325659)\n\nThis update fixes the following issues:\n\npy26-compat-salt:\n\n- Update Salt version to 2016.11.10\n\n- CVE-2018-15750: Fixed directory traversal vulnerability in salt-api (bsc#1113698).\n- CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi) that allows to execute arbitrary commands (bsc#1113699).\n\n- Fix wrong recurse behavior on for linux_acl.present (bsc#1106164)\n- Adding backport for string arg normalization and fix for SUSE ES os\n- Prepend current directory when path is just filename (bsc#1095942)\n\nsmdba:\n\n- Add support for postgresql 10 (fate#325659)\n\nspacecmd:\n\n- Show group id on group_details (bsc#1111542)\n- State channels handling: Existing commands configchannel_create and configchannel_import were updated\n  while system_scheduleapplyconfigchannels and configchannel_updateinitsls were added.\n\nspacewalk:\n\n- Add support for postgresql10 (fate#325659)\n\nspacewalk-backend:\n\n- Channels to be actually un-subscribed from the assigned systems when being removed\n  using spacewalk-remove-channel tool(bsc#1104120)\n\nspacewalk-branding:\n\n- New messages are added for XMLRPC API for state channels\n\nspacewalk-doc-indexes:\n\n- Use nutch-core dependency instead of nutch\n\nspacewalk-java:\n\n- Change Requires to allow installing with both Tomcat 8 (SLE-12SP3) and 9 (SLE12-SP4)\n- Fix typo in messages (bsc#1111249)\n- Remove restrictions on SUSE Manager Channel subscriptions (bsc#1105724)\n- Added shortcut for editing Software Channel\n- Fix NullPointerException when refreshing deleted software channel (bsc#1094992)\n- Add last_boot to listSystems() API call\n- Check valid postgresql database version\n- Fix displayed number of systems requiring reboot in Tasks pane (bsc#1106875)\n- Changed localization strings for file summaries (bsc#1090676)\n- Added menu item entries for creating/deleting file preservation lists (bsc#1034030)\n- Better error handling when a websocket connection is aborted (bsc#1080474)\n- Remove the reference of channel from revision before deleting it(bsc#1107850)\n- Added link from virtualization tab to Scheduled \u003e Pending Actions (bsc#1037389)\n- Speedup package listings(bsc#1100852)\n- Method to Unsubscribe channel from system(bsc#1104120)\n- Fix mgr-sync refresh when subscription was removed (bsc#1105720)\n- Fix an error in the system software channels UI due to SUSE product channels missing a\n  corresponding synced channel (bsc#1105886)\n- XMLRPC API for state channels\n- Optimize execution of actions in minions (bsc#1099857)\n- Reschedule taskomatic jobs if task threads limit reached (bsc#1096511)\n- Logic constraint: results must be ordered and grouped by systemId first (bsc#1101033)\n- Do not wrap output if stderr is not present (bsc#1105074)\n\nspacewalk-search:\n\n- Discard commons-logging.properties removal on spec file, as OBS package does not contain it\n- Upgrade tika-core to 0.19.1 and adjust nutch-core (bsc#1109235)\n- Remove lib jar files and add them as build dependencies on spec\n- Limit number of old java logfiles (bsc#1107869)\n\nspacewalk-utils:\n\n- Fix typo at --phases option help\n\nspacewalk-web:\n\n- Fix typo in messages (bsc#1111249)\n- Fix Sles name in base channel filter (Visualization tab) (bsc#1042184)\n\nsubscription-matcher:\n\n- Set core dumps location for IBM java (bsc#1107302)\n- Fix OutOfMemoryError crashes (bsc#1094524) \n- Updated to version 0.20\n- Update partnumbers rule file (bsc#1095972)\n- Use intermediate object to store confirmed matches within a\n  penalty group and prevent infinite reactivation of Inherited\n  virtualization rule (bsc#1094524)\n\nsusemanager:\n\n- Add new option --with-parent-channel to mgr-create-bootrap-repo\n  to specify parent channel to use if multiple options are available\n  (bsc#1104487)\n- Add support for postgresql10 (fate#325659)\n- Bootstrap repos for SLE12 SP4 (bsc#1107117)\n\nsusemanager-branding-oss:\n\n- Use ASCII quotation marks in license file (bsc#1098970)\n\nsusemanager-schema:\n\n- Check valid postgresql database version\n\nsusemanager-sls:\n\n- Deploy SSL certificate during onboarding of openSUSE Leap 15.0 (bsc#1112163)\n- Removed the ssl certificate verification while checking bootstrap repo URL (bsc#1095220)\n- Removed the need for curl to be present at bootstrap phase (bsc#1095220)\n\nsusemanager-sync-data:\n\n- SUSE OpenStack Cloud 9 enablement (bsc#1113557)\n- Add SUSE Manager 3.1 on SLES12 SP4\n- Support SLE12 SP4 product family (bsc#1107117)\n- Add CaaSP 3.0 channels (bsc#1105045)\n\nAdditionally some Java components have been split out of existing packages for better maintenance:\n\n- apache-mybatis\n- hadoop\n- icu4j\n- lucene\n- nekohtml\n- nutch-core\n- picocontainer\n- tagsoup\n- tika-core\n\n","status":"published","published":"2018-11-19T16:53:28Z","modified":"2026-02-04T02:56:27.068984Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-4769-1","title":"salt vulnerabilities","description":"It was discovered that Salt allowed remote attackers to write to\narbitrary files via a special crafted file. An attacker could use this\nvulnerability to cause a DoS or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 ESM. (CVE-2014-3563)\n\nAndreas Stieger discovered that Salt exposed git usernames and passwords\nin log files. An attacker could use this issue to retrieve sensitive\ninformation. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6918).\n\nIt was discovered that Salt exposed password authentication\ncredentials in log files. An attacker could use this issue to retrieve\nsensitive information. This issue only affected Ubuntu 14.04 ESM.\n(CVE-2015-6941)\n\nIt was discovered that Salt allowed remote attackers to write to\narbitrary files via a special crafted file. An attacker could use this \nissue to cause a DoS or possibly execute arbitrary code. (CVE-2017-12791,\nCVE-2017-14695, CVE-2017-14696)\n\nIt was discovered that Salt allowed remote attackers to determine which\nfiles exist on the server. An attacker could use this issue to extract\nsensitive information. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-15750)\n\nIt was discovered that Salt allowed users to bypass authentication. An\nattacker could use this issue to extract sensitive information, execute\narbitrary code or crash the server. This issue only affected Ubuntu 16.04\nESM. (CVE-2018-15751)","status":"published","published":"2021-03-15T20:11:16Z","modified":"2026-06-29T13:48:13.302310265Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}