CVE-2017-14695
salt: Directory traversal in minion id validation
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Photon OS. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | salt | 2017.7.2-1.ph1 |
| pip::GitHub Security Advisory pip | salt | 2016.3.8, 2016.11.8, 2017.7.2 |
| debian 8 | salt | düzeltme belirtilmemiş |
| debian 9 | salt | 2016.11.2+ds-1+deb9u1 |
| Red Hat | salt, salt-minion | düzeltme belirtilmemiş |
| ubuntu 14.04-ESM | salt | 0.17.5+ds-1ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1+esm1 |
7 kaynaktaki 8 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | salt | 2017.7.2-1.ph1 |
| pip::GitHub Security Advisory pip | salt | 2016.3.8, 2016.11.8, 2017.7.2 |
| debian 8 | salt | düzeltme belirtilmemiş |
| debian 9 | salt | 2016.11.2+ds-1+deb9u1 |
| Red Hat | salt | düzeltme belirtilmemiş |
| Red Hat | salt-minion | düzeltme belirtilmemiş |
| ubuntu 14.04-ESM | salt | 0.17.5+ds-1ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1+esm1 |
Referanslar
- http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html
- http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html
- https://access.redhat.com/security/cve/CVE-2017-14695
- https://bugzilla.redhat.com/show_bug.cgi?id=1500748
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-14695
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html
- https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html
- https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html
14 referansın hepsi
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-36.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d
- https://nvd.nist.gov/vuln/detail/CVE-2017-14695
- https://ubuntu.com/security/notices/USN-4769-1
- https://www.cve.org/CVERecord?id=CVE-2017-14695