CVE-2017-14696
HighSummary
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
Risk Assessment
Attackers can exploit this vulnerability to disrupt system operations, potentially leading to service outages.
Recommendation
It is recommended to update SaltStack Salt to the latest version to mitigate this vulnerability.
Other vulnerabilities in SaltStack Salt
See all- CVE-2017-5200High
Salt-api in SaltStack before version 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.
- CVE-2017-5192High
In SaltStack Salt versions before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, the local_batch client from salt-api does not respect external authentication, allowing all authentication to be bypassed.
- CVE-2017-8109High
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions.
- CVE-2017-14695Critical
Directory traversal vulnerability in minion id validation in SaltStack Salt before version 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
- CVE-2017-12791Critical
CVE-2017-12791 describes a vulnerability in minion ID validation in SaltStack Salt before version 2016.11.7 and 2017.7.x before 2017.7.1. This allows remote minions with incorrect credentials to authenticate to a master using a crafted minion ID.
Original NVD description (English source)
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.