CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2017-14696
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
Severity
- EPSS
- 3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saltstack:salt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-657p-cj5r-mjrh | PyPI | salt | <2016.3.8 | 2016.3.8 |
| GHSA-657p-cj5r-mjrh | PyPI | salt | >=2016.11.0 <2016.11.8 | 2016.11.8 |
| GHSA-657p-cj5r-mjrh | PyPI | salt | >=2017.7.0 <2017.7.2 | 2017.7.2 |
| PYSEC-2017-37 | PyPI | salt | <2016.3.8 >=2016.11 <2016.11.8 >=2017.7 <2017.7.2 | 2016.3.8, 2016.11.8, 2017.7.2 |
References
- http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html
- http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1500742
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html
- https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html