[Pkg-salt-team] Bug#872399: salt: CVE-2017-12791: Directory traversal vulnerability on salt-master via crafted minion IDs

[Salvatore Bonaccorso]

Source: salt
Version: 2016.11.5+ds-1
Severity: grave
Tags: security upstream patch
Forwarded: https://github.com/saltstack/salt/pull/42944

Hi,

the following vulnerability was published for salt.

CVE-2017-12791[0]:
Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-12791
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12791
[1] https://github.com/saltstack/salt/pull/42944
[2] https://github.com/saltstack/salt/commit/6366e05d0d70bd709cc4233c3faf32a759d0173a

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore