[Pkg-salt-team] Bug#913476: salt: CVE-2018-15750: Directory traversal in salt-api allows remote attackers to identitfy arbitrary files

[Salvatore Bonaccorso]

Source: salt
Version: 2017.7.4+dfsg1-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for salt.

CVE-2018-15750[0]:
| Directory Traversal vulnerability in salt-api in SaltStack Salt before
| 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to
| determine which files exist on the server.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-15750
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15750
[1] https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
    https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore