CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12791
https://notcve.org/view.php?id=CVE-2017-12791
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Una vulnerabilidad de salto de directorio en la validación minion id en SaltStack Salt en versiones anteriores a la 2016.11.7 y 2017.7.x en versiones anteriores a la 2017.7.1 permite que minions remotos con credenciales incorrectas se autentiquen en un master mediante un ID minion manipulado. • http://www.securityfocus.com/bid/100384 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399 https://bugzilla.redhat.com/show_bug.cgi?id=1482006 https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html https://github.com/saltstack/salt/pull/42944 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1839
https://notcve.org/view.php?id=CVE-2015-1839
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. modules/chef.py en SaltStack en versiones anteriores a 2014.7.4 no maneja correctamente archivos en /tmp. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html https://bugzilla.redhat.com/show_bug.cgi?id=1212788 https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5c https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81 • CWE-19: Data Processing Errors •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1838
https://notcve.org/view.php?id=CVE-2015-1838
modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. modules/serverdensity_device.py en SaltStack en versiones anteriores a 2014.7.4 no maneja correctamente archivos en /tmp. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html https://bugzilla.redhat.com/show_bug.cgi?id=1212784 https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c • CWE-19: Data Processing Errors •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9639
https://notcve.org/view.php?id=CVE-2016-9639
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. Salt en versiones anteriores a 2015.8.11 permite a minions eliminados para leer o escribir minions con el mismo id, relacionado con el almacenamiento en caché. • http://www.openwall.com/lists/oss-security/2016/11/25/2 http://www.openwall.com/lists/oss-security/2016/11/25/3 http://www.securityfocus.com/bid/94553 https://docs.saltstack.com/en/2015.8/ref/configuration/master.html#rotate-aes-key • CWE-284: Improper Access Control •
CVSS: 5.6EPSS: 0%CPEs: 8EXPL: 0CVE-2016-3176
https://notcve.org/view.php?id=CVE-2016-3176
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient. Salt en versiones anteriores a 2015.5.10 y 2015.8.x en versiones anteriores a 2015.8.8, cuando la autenticación externa de PAM está habilitada, permite a atacantes eludir el servicio de autenticación configurado pasando un servicio alternativo con un comando enviado a LocalClient. • https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html • CWE-287: Improper Authentication •