Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
{ "nvd_published_at": "2017-10-24T17:29:00Z", "cwe_ids": [ "CWE-22" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-04-22T22:20:25Z" }