=============================
Salt 2016.11.10 Release Notes
=============================

Version 2016.11.10 is a security release for :ref:`2016.11.0 <release-2016-11-0>`.

Changes for v2016.11.9..v2016.11.10
-----------------------------------

Security Fix
============

CVE-2018-15751 Remote command execution and incorrect access control when using salt-api.

CVE-2018-15750 Directory traversal vulnerability when using salt-api. Allows an attacker to determine what files exist on a server when querying /run or /events.

Credit and thanks for discovery and responsible disclosure: nullbr4in, xcuter, koredge, loupos, blackcon, Naver Business Platform
