CVE-2017-5200

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's sshclient...

CVE-2017-5192

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed...

CVE-2017-5200

Removed by vendor...

CVE-2017-5200

CVE-2017-5200 affects SaltStack Salt’s Salt-api via ssh_client, enabling arbitrary command execution on the salt-master. Affected versions include Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2. Mitigation: apply the fixed releases (e.g., Salt 2015.8.13, 2016.3.5,...

CVE-2017-5192

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed...

openSUSE Security Update : salt (openSUSE-2017-1016)

This update for salt fixes the following issues : - Update to 2017.7.1 See https://docs.saltstack.com/en/develop/topics/releases/20 17.7.1.html for full changelog - CVE-2017-12791: crafted minion ID could lead directory traversal on the Salt-master boo1053955 - Run fdupes over all of /usr because...

CVE-2015-4017

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

PYSEC-2017-31

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

UBUNTU-CVE-2015-4017

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

CVE-2015-4017

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

PYSEC-2017-31

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

Code injection

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

CVE-2015-4017

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

CVE-2015-4017

CVE-2015-4017 describes a vulnerability in Salt prior to 2014.7.6 where certificate verification is not performed when Salt connects via the aliyun, proxmox, and splunk modules. According to the connected SUSE/OSV records, the issue centers on Salt’s failure to validate certificates, potentially ...

CVE-2015-4017

Removed by vendor...

CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

CVE-2017-12791

CVE-2017-12791 is a SaltStack directory traversal vulnerability in minion ID validation. The issue affects Salt before 2016.11.7 and 2017.7.x before 2017.7.1, allowing remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. The vulnerability stems from insuf...

[ASA-201708-17] salt: directory traversal

Arch Linux Security Advisory ASA-201708-17 ========================================== Severity: Medium Date : 2017-08-23 CVE-ID : CVE-2017-12791 Package : salt Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-383 Summary ======= The package salt before version...

Directory Traversal

salt is vulnerable to directory traversal attacks. The attack is possible because minion ids are not properly checked, allowing a malicious user to pass a minion id containing escape characters to traverse the filesystem...