CVE-2017-12791

Опубликовано: 23 авг. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

Ссылки

http://www.securityfocus.com/bid/100384
Third Party Advisory
VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399
Issue Tracking
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1482006
Issue Tracking
Patch
Third Party Advisory
https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html
Patch
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html
Patch
Release Notes
Vendor Advisory
https://github.com/saltstack/salt/pull/42944
Issue Tracking
Patch
Third Party Advisory
http://www.securityfocus.com/bid/100384
Third Party Advisory
VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399
Issue Tracking
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1482006
Issue Tracking
Patch
Third Party Advisory
https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html
Patch
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html
Patch
Release Notes
Vendor Advisory
https://github.com/saltstack/salt/pull/42944
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия до 2016.11.6 (включая)

cpe:2.3:a:saltstack:salt:2017.7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01383

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2017-12791

CVSS3: 9.8

ubuntu

почти 8 лет назад

CVE-2017-12791

CVSS3: 5.3

redhat

почти 8 лет назад

CVE-2017-12791

CVSS3: 9.8

debian

почти 8 лет назад

Directory traversal vulnerability in minion id validation in SaltStack ...

openSUSE-SU-2017:2383-1

suse-cvrf

почти 8 лет назад

Security update for salt

SUSE-SU-2017:2676-1

suse-cvrf

больше 7 лет назад

Security update for Salt

EPSS

Процентиль: 79%

0.01383

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22