CVE-2017-14695

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-14695
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14695.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-14695
Aliases
Downstream
Related
Published
2017-10-24T17:29:00.323Z
Modified
2026-05-07T04:39:43.365938Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:saltstack:salt:2016.11.1:rc1:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "2016.11.1-rc1"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:saltstack:salt:2016.11.1:rc2:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "2016.11.1-rc2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/saltstack/salt

Affected ranges

Type
GIT
Repo
https://github.com/saltstack/salt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e0dfb572aeb0c3fa2115cfbdebc08ae3e80b9124
Last affected
22a134f9d83e718e36e3e66744758ab4f56fadc3
Last affected
0d59712f651ca8fadfe66f205afffd6e9b94587e
Last affected
53b1d88d0415d9b3d78266d6c232472a2a6f032c
Last affected
ec59ae67c82e2bc63e16b05d95492a0756257207
Last affected
b03ae0f432239d46e2f447d98c4eb6eb4e61adfe
Last affected
184093e7470d77012229f6b46eb39cd510e99c8c
Last affected
90c862d98493c487aa00e82d2c19c599d1fe611d
Last affected
d6cc41f0e5337403414cfbacf7c8d8dc467ccd83
Last affected
f8efcd9091f95a9e7020cb892963794254628f18
Last affected
2fd9642d50cdc3ddbc70023941f3b6676757b482
Last affected
45a75e2f5da4999304e105d762b5be96da02ef45
Last affected
79c9e76ae83c36afb11d5de9ecc2470b9fd9a974
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": [
        "cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2016.11.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2017.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2017.7.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:saltstack:salt:2017.7.1:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2016.3.7"
        },
        {
            "last_affected": "2016.11"
        },
        {
            "last_affected": "2016.11.0"
        },
        {
            "last_affected": "2016.11.1"
        },
        {
            "last_affected": "2016.11.2"
        },
        {
            "last_affected": "2016.11.3"
        },
        {
            "last_affected": "2016.11.4"
        },
        {
            "last_affected": "2016.11.5"
        },
        {
            "last_affected": "2016.11.6"
        },
        {
            "last_affected": "2016.11.7"
        },
        {
            "last_affected": "2017.7.0"
        },
        {
            "last_affected": "2017.7.0-rc1"
        },
        {
            "last_affected": "2017.7.1"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16
v0.17
v0.6.0
v0.7.0
v0.8.0
v0.8.7
v0.8.9
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.9
v2014.*
v2014.1
v2014.7
v2015.*
v2015.2
v2015.5
v2015.8
v2016.*
v2016.11
v2016.11.0
v2016.11.0rc1
v2016.11.0rc2
v2016.11.1
v2016.11.2
v2016.3
v2016.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14695.json"