GCVE - cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*

part: a version: 2016.11.2 update: *

Vendor	Saltstack (`505beb5a-4fc5-5540-9632-5d28b16aab0d`)
Product	Salt (`dd0d2bbf-d65f-5171-9eae-a243e2f3cc18`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/saltstack/salt`	purl2cpe	2026-06-01 10:16:14.783270
`pkg:rpm/fedora/salt`	purl2cpe	2026-06-01 10:16:14.783271
`pkg:rpm/opensuse/salt`	purl2cpe	2026-06-01 10:16:14.783272

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-8109`	vulnerable	2026-06-08 05:10:07.237944	Details available The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients). Published: 2017-04-25T17:00:00.000Z Updated: 2024-08-05T16:27:22.195Z Open on db.gcve.eu Reference links https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658 https://github.com/saltstack/salt/issues/40075 https://github.com/saltstack/salt/pull/40609 https://bugzilla.suse.com/show_bug.cgi?id=1035912 http://www.securityfocus.com/bid/98095	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5200`	vulnerable	2026-06-08 05:09:39.331563	Details available Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. Published: 2017-09-26T14:00:00.000Z Updated: 2024-08-05T14:55:35.542Z Open on db.gcve.eu Reference links https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5192`	vulnerable	2026-06-08 05:09:39.321279	Details available When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Published: 2017-09-26T14:00:00.000Z Updated: 2024-08-05T14:55:35.454Z Open on db.gcve.eu Reference links https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14696`	vulnerable	2026-06-08 05:08:57.171863	Details available SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request. Published: 2017-10-24T17:00:00.000Z Updated: 2024-08-05T19:34:39.957Z Open on db.gcve.eu Reference links https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14695`	vulnerable	2026-06-08 05:08:57.166807	Details available Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791. Published: 2017-10-24T17:00:00.000Z Updated: 2024-08-05T19:34:39.872Z Open on db.gcve.eu Reference links https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html https://bugzilla.redhat.com/show_bug.cgi?id=1500748 https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.