CVE-2017-14695

Опубликовано: 24 окт. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Ссылки

http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html
Issue Tracking
Release Notes
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html
Issue Tracking
Release Notes
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500748
Issue Tracking
Release Notes
Third Party Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html
Issue Tracking
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html
Issue Tracking
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html
Issue Tracking
Release Notes
Vendor Advisory
https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d
Issue Tracking
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html
Issue Tracking
Release Notes
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html
Issue Tracking
Release Notes
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500748
Issue Tracking
Release Notes
Third Party Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html
Issue Tracking
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html
Issue Tracking
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html
Issue Tracking
Release Notes
Vendor Advisory
https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия до 2016.3.7 (включая)

cpe:2.3:a:saltstack:salt:2016.11:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.1:rc1:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.1:rc2:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.3:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.4:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.5:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.6:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.7:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2017.7.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2017.7.0:rc1:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2017.7.1:*:*:*:*:*:*:*

EPSS

Процентиль: 56%

0.00331

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2017-14695

CVSS3: 9.8

ubuntu

больше 8 лет назад

CVE-2017-14695

CVSS3: 8

redhat

больше 8 лет назад

CVE-2017-14695

CVSS3: 9.8

debian

больше 8 лет назад

Directory traversal vulnerability in minion id validation in SaltStack ...

GHSA-j6gj-pg62-x8j6

CVSS3: 9.8

github

больше 3 лет назад

SaltStack Salt Directory traversal vulnerability in minion id validation

openSUSE-SU-2017:2824-1

suse-cvrf

больше 8 лет назад

Security update for salt

EPSS

Процентиль: 56%

0.00331

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22