CVE-2017-14695

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-14695
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14695.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-14695
Aliases
Downstream
Related
Published
2017-10-24T17:29:00.323Z
Modified
2026-03-10T14:24:14.231251Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

References

Affected packages

Git / github.com/saltstack/salt

Affected ranges

Type
GIT
Repo
https://github.com/saltstack/salt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
11d176ff1b3c72a529a641c780de6bf70b792253
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f76dc0f9c06dd0690447a31544b7bd1fe7f5765a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f44724cca5147595557cba04ff215ee31c35fe73
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f7294dc85bdd975022f53cfb241877059208f82b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ec59ae67c82e2bc63e16b05d95492a0756257207
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
40f72db53e2b22e7ef88e1e150caedfdf10772f1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e5cd6086a75818885f2bd5bee3d7da3b2c07b110
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a10f0146a42338e04a4e2d8066f1ee99571c9fbd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
afc61ffe63770a731154f1380a91d566248a8fae
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d15dce349611a970fff8d3ffb462ef95ce7b2360
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
81695a9f3c9bfa9224a4b58426e872e823112926
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
965583fa55f0c34c0f17c6a16584f44b97942e0b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0931281ebd1ca794b27bf7dc4e918efd3a05c612
Fixed
80d90307b07b3703428ecbb7c8bb468e28a9ae6d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.3.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.11.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2017.7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2017.7.0-rc1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2017.7.1"
        }
    ]
}

Affected versions

old-branch-2014.*
old-branch-2014.7
old-branch-2015.*
old-branch-2015.5
old-branch-2015.8
v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16
v0.17
v0.6.0
v0.7.0
v0.8.0
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v2014.*
v2014.1
v2014.7
v2014.7.0
v2014.7.0rc1
v2014.7.0rc2
v2014.7.0rc3
v2014.7.0rc4
v2014.7.0rc5
v2014.7.0rc6
v2014.7.0rc7
v2014.7.1
v2014.7.2
v2014.7.3
v2014.7.4
v2014.7.5
v2014.7.6
v2014.7.7
v2014.7.8
v2014.7.9
v2015.*
v2015.2
v2015.2.0rc1
v2015.2.0rc2
v2015.5
v2015.5.0
v2015.5.1
v2015.5.11
v2015.5.2
v2015.5.3
v2015.5.4
v2015.5.5
v2015.5.6
v2015.5.7
v2015.5.8
v2015.5.9
v2015.8
v2015.8.0
v2015.8.0rc1
v2015.8.0rc2
v2015.8.0rc3
v2015.8.0rc4
v2015.8.0rc5
v2015.8.1
v2015.8.11
v2015.8.12
v2015.8.13
v2015.8.2
v2015.8.3
v2015.8.4
v2015.8.8
v2015.8.9
v2016.*
v2016.11
v2016.11.0
v2016.11.0rc1
v2016.11.0rc2
v2016.11.1
v2016.11.2
v2016.11.3
v2016.11.4
v2016.11.5
v2016.11.6
v2016.3
v2016.3.0
v2016.3.0rc0
v2016.3.0rc1
v2016.3.0rc2
v2016.3.0rc3
v2016.3.1
v2016.3.2
v2016.3.3
v2016.3.4
v2016.3.5
v2016.3.6
v2016.9
v2017.*
v2017.5
v2017.7
v2017.7.0
v2017.7.0rc1
v2017.7.1

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2016.11.1-rc1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2016.11.1-rc2"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14695.json"