Description
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | salt | 2015.8.8+ds-1ubuntu0.1+esm1 | USN-4769-1 |
| Ubuntu Pro 14.04 LTS | salt | 0.17.5+ds-1ubuntu0.1~esm1 | USN-4769-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SLES 11 SP4 | salt | 2016.11.4-43.10.2 | SUSE-SU-2017:3381-1 |
| SLES 11 SP3 | salt | 2016.11.4-43.10.2 | SUSE-SU-2017:3381-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.1 | apache-mybatis | 3.2.3-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | hadoop | 0.18.1-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | icu4j | 55.1-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | lucene | 2.4.1-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | nekohtml | 1.9.21-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | nutch-core | 1.0.1-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | picocontainer | 1.3.7-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | py26-compat-salt | 2016.11.10-1.16.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SUSE Manager Server 3.1 | smdba | 1.6.2-0.2.9.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacecmd | 2.7.8.13-2.26.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk | 2.7.0.6-2.6.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-backend | 2.7.73.15-2.26.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-branding | 2.7.2.15-2.25.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-doc-indexes | 2.7.0.4-2.6.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-java | 2.7.46.17-2.35.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-search | 2.7.3.6-2.16.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-utils | 2.7.10.9-2.17.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | spacewalk-web | 2.7.1.19-2.29.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | subscription-matcher | 0.21-4.6.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | supportutils-plugin-salt | 1.1.4-6.9.1 | SUSE-SU-2018:1757-1 |
| SUSE Manager Server 3.1 | susemanager | 3.1.16-2.26.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | susemanager-branding-oss | 3.1.2-3.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | susemanager-schema | 3.1.20-2.33.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | susemanager-sls | 3.1.19-2.30.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | susemanager-sync-data | 3.1.16-2.29.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | tagsoup | 1.2.1-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.1 | tika-core | 1.19.1-1.3.1 | SUSE-SU-2018:3811-1 |
| SUSE Manager Server 3.0 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SUSE Manager Server 3.0 | supportutils-plugin-salt | 1.1.4-6.9.1 | SUSE-SU-2018:1757-1 |
| SUSE Manager Proxy 3.1 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SUSE Manager Proxy 3.1 | supportutils-plugin-salt | 1.1.4-6.9.1 | SUSE-SU-2018:1757-1 |
| SUSE Manager Proxy 3.0 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SUSE Manager Proxy 3.0 | supportutils-plugin-salt | 1.1.4-6.9.1 | SUSE-SU-2018:1757-1 |
| SUSE Manager Client Tools 12 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-salt | 1.1.4-6.9.1 | SUSE-SU-2018:1757-1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | salt | 2016.11.4-46.10.1 | SUSE-SU-2018:1757-1, SUSE-SU-2017:3380-1 |
| SUSE Enterprise Storage 5 | salt | 2016.11.4-46.10.1 | SUSE-SU-2017:3380-1 |
| SUSE Enterprise Storage 4 | salt | 2016.11.4-46.10.1 | SUSE-SU-2017:3380-1 |
| SUSE Enterprise Storage 3 | salt | 2016.11.4-46.10.1 | SUSE-SU-2017:3380-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | < 2016.3.8 | 2016.3.8 | GHSA-j6gj-pg62-x8j6 |
| PyPI | salt | >= 2016.11.0, < 2016.11.8 | 2016.11.8 | GHSA-j6gj-pg62-x8j6 |
| PyPI | salt | >= 2017.7.0, < 2017.7.2 | 2017.7.2 | GHSA-j6gj-pg62-x8j6 |
| PyPI | salt | < 2016.3.8 · >= 2016.11, < 2016.11.8 · >= 2017.7, < 2017.7.2 | 2016.3.8, 2016.11.8, 2017.7.2 | PYSEC-2017-36 |
Advisories 5
- USN-4769-1 salt vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- SUSE-SU-2017:3381-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1757-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3811-1 Security update for SUSE Manager Server 3.1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:3380-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html
- openSUSE-SU-2017:2824 vendor-advisory
- openSUSE-SU-2017:2822 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1500748
- https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html
- https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d