saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Update 2016.3.7 Release Notes

Browse source
This commit is contained in:
Ch3LL 2017-08-31 13:13:29 -04:00
parent 0425defe84
commit 8cf08bd7be
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
doc/topics/releases/2016.3.7.rst
View file

@ -7,5 +7,9 @@ Version 2016.3.7 is a bugfix release for :ref:`2016.3.0 <release-2016-3-0>`.
Changes for v2016.3.6..v2016.3.7
--------------------------------
- Correct a flaw in minion id validation which could allow certain minions to
authenticate to a master despite not having the correct credentials.
Security Fix
============
CVE-2017-12791 Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master
Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com