Published: 24/10/2017 Updated: 15/11/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

SaltStack Salt prior to 2016.3.8, 2016.11.x prior to 2016.11.8, and 2017.7.x prior to 2017.7.2 allows remote malicious users to cause a denial of service via a crafted authentication request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
saltstack salt
saltstack salt 2016.11
saltstack salt 2016.11.0
saltstack salt 2016.11.1
saltstack salt 2016.11.2
saltstack salt 2017.7.0
saltstack salt 2016.11.4
saltstack salt 2016.11.5
saltstack salt 2016.11.6
saltstack salt 2016.11.7
saltstack salt 2016.11.3
saltstack salt 2017.7.1

Debian Bug report logs - #872399 salt: CVE-2017-12791: Directory traversal vulnerability on salt-master via crafted minion IDs Package: src:salt; Maintainer for src:salt is Debian Salt Team <pkg-salt-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 17 Aug 2017 03:54:02 UT ...

Debian Bug report logs - #879090 salt: CVE-2017-14696: Remote DoS via crated authentication request Package: src:salt; Maintainer for src:salt is Debian Salt Team <pkg-salt-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 19 Oct 2017 08:06:01 UTC Severity: important Tags ...

Debian Bug report logs - #879089 salt: CVE-2017-14695: Directory traversal in minion id validation Package: src:salt; Maintainer for src:salt is Debian Salt Team <pkg-salt-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 19 Oct 2017 08:03:01 UTC Severity: important Tags: ...

It has been discovered that salt incorrectly handled IDs with null bytes in decoded payloads A specially crafted authentication request will crash the application while processing ...

CWE-20 https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html https://bugzilla.redhat.com/show_bug.cgi?id=1500742 http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399 https://security.archlinux.org/CVE-2017-14696

CVE-2017-14696

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect