CVE-2024-22231

Advisory

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

========================

Security
--------

- Fix CVE-2024-22231 Prevent directory traversal when creating syndic cache directory on the master.
- Fix CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.

These vulnerablities were discovered and reported by:
Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (565)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22231
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22232