[Pkg-salt-team] Bug#872399: salt: CVE-2017-12791: Directory traversal vulnerability on salt-master via crafted minion IDs
Salvatore Bonaccorso
carnil at debian.org
Thu Aug 17 03:50:26 UTC 2017
Source: salt
Version: 2016.11.5+ds-1
Severity: grave
Tags: security upstream patch
Forwarded: https://github.com/saltstack/salt/pull/42944
Hi,
the following vulnerability was published for salt.
CVE-2017-12791[0]:
Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-12791
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12791
[1] https://github.com/saltstack/salt/pull/42944
[2] https://github.com/saltstack/salt/commit/6366e05d0d70bd709cc4233c3faf32a759d0173a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
More information about the pkg-salt-team
mailing list