CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5192
https://notcve.org/view.php?id=CVE-2017-5192
When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Al utilizar el cliente local_batch de salt-api en SaltStack Salt en versiones anteriores a la 2015.8.13, las versiones 2016.3.x anteriores a 2016.3.5 y las versiones 2016.11.x anteriores a 2016.11.2, no se respeta la autenticación externa, por lo que se permite la omisión de todas las autenticaciones. • https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5200
https://notcve.org/view.php?id=CVE-2017-5200
Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. salt-api en SaltStack Salt en versiones anteriores a la 2015.8.13, las versiones 2016.3.x anteriores a 2016.3.5 y las versiones 2016.11.x anteriores a 2016.11.2 permite la ejecución arbitraria de comandos en un salt_master mediante el ssh_client de Salt. • https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4017
https://notcve.org/view.php?id=CVE-2015-4017
Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. Salt en versiones anteriores a la 2014.7.6 no verifica los certificados cuando se conecta mediante los módulos aliyun, proxmox y splunk. • http://www.openwall.com/lists/oss-security/2015/05/19/2 https://bugzilla.redhat.com/show_bug.cgi?id=1222960 https://docs.saltstack.com/en/latest/topics/releases/2014.7.6.html https://groups.google.com/forum/#%21topic/salt-users/8Kv1bytGD6c • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12791
https://notcve.org/view.php?id=CVE-2017-12791
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Una vulnerabilidad de salto de directorio en la validación minion id en SaltStack Salt en versiones anteriores a la 2016.11.7 y 2017.7.x en versiones anteriores a la 2017.7.1 permite que minions remotos con credenciales incorrectas se autentiquen en un master mediante un ID minion manipulado. • http://www.securityfocus.com/bid/100384 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399 https://bugzilla.redhat.com/show_bug.cgi?id=1482006 https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html https://github.com/saltstack/salt/pull/42944 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2015-6941
https://notcve.org/view.php?id=CVE-2015-6941
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. win_useradd, salt-cloud y el driver Linode en salt en versones 2015.5.x anteriores a la 2015.5.6 y en verisones 2015.8.x anteriores a la 2015.8.1 filtran información de contraseñas en logs de depuración. • https://bugzilla.redhat.com/show_bug.cgi?id=1273066 https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710 • CWE-534: DEPRECATED: Information Exposure Through Debug Log Files •