ASA-201710-12 log original external raw

[ASA-201710-12] salt: multiple issues
Arch Linux Security Advisory ASA-201710-12 ========================================== Severity: Medium Date : 2017-10-09 CVE-ID : CVE-2017-14695 CVE-2017-14696 Package : salt Type : multiple issues Remote : Yes Link : Summary ======= The package salt before version 2017.7.2-1 is vulnerable to multiple issues including denial of service and directory traversal. Resolution ========== Upgrade to 2017.7.2-1. # pacman -Syu "salt>=2017.7.2-1" The problems have been fixed upstream in version 2017.7.2. Workaround ========== None. Description =========== - CVE-2017-14695 (directory traversal) It has been discovered that maliciously crafted minion IDs can cause unwanted directory traversals on the salt-master. The flaw is within the minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing path seperators that will cause a directory traversal. - CVE-2017-14696 (denial of service) It has been discovered that salt incorrectly handled IDs with null bytes in decoded payloads. A specially crafted authentication request will crash the application while processing. Impact ====== An unauthenticated attacker is able to craft a malicious minion ID to cause a directory traversal on the salt-master or send a specially crafted authentication request to crash the application. References ==========!topic/salt-announce/X8ZiQrZLujA