Arch Linux Security Advisory ASA-201710-12 ========================================== Severity: Medium Date : 2017-10-09 CVE-ID : CVE-2017-14695 CVE-2017-14696 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-438 Summary ======= The package salt before version 2017.7.2-1 is vulnerable to multiple issues including denial of service and directory traversal. Resolution ========== Upgrade to 2017.7.2-1. # pacman -Syu "salt>=2017.7.2-1" The problems have been fixed upstream in version 2017.7.2. Workaround ========== None. Description =========== - CVE-2017-14695 (directory traversal) It has been discovered that maliciously crafted minion IDs can cause unwanted directory traversals on the salt-master. The flaw is within the minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing path seperators that will cause a directory traversal. - CVE-2017-14696 (denial of service) It has been discovered that salt incorrectly handled IDs with null bytes in decoded payloads. A specially crafted authentication request will crash the application while processing. Impact ====== An unauthenticated attacker is able to craft a malicious minion ID to cause a directory traversal on the salt-master or send a specially crafted authentication request to crash the application. References ========== https://groups.google.com/forum/#!topic/salt-announce/X8ZiQrZLujA https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a... https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a5... https://security.archlinux.org/CVE-2017-14695 https://security.archlinux.org/CVE-2017-14696