CVE-2017-14695

Critical

Published: 24/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Directory traversal vulnerability in minion id validation in SaltStack Salt before version 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

Risk Assessment

This vulnerability may lead to unauthorized access to the system, posing a serious security threat to the organization.

Recommendation

It is recommended to update SaltStack to the latest version to eliminate this vulnerability and ensure proper validation of minion IDs.

Original NVD description (English source)

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.