GHSA-jx34-pppm-gjvr

SaltStack Salt Directory Traversal vulnerability in salt-api

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-15750

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	>= 2017.7.0, < 2017.7.8	2017.7.8
PyPI	salt	>= 2018.3.0, < 2018.3.3	2018.3.3
PyPI	salt	>= 2016.11.0, < 2016.11.10	2016.11.10

Details

As written in the advisory (Markdown source, shown as plain text).

Directory Traversal vulnerability in salt-api in SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-15750 advisory
https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html web
https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html web
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2018-29.yaml web
https://github.com/saltstack/salt package
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2016.11.10.rst#L15 web
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2017.7.8.rst#L28 web
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2018.3.3.rst#L58 web
https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ web
https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ web
https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html web
https://usn.ubuntu.com/4459-1 web
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html web