FreeBSD : salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master (3531141d-a708-477c-954a-2a0549e49ca9)

SaltStack reports : Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory...

Path Injection Via Minion Ids

Salt is vulnerable to path injection attacks via minion ids. Salt masters do not properly validate the id of a connecting minion. This can lead to an attacker uploading files to the master in arbitrary locations. In particular, this can be used to bypass the manual validation of new unknown...