-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2016.3.8 | 2016.3.8 |
| salt | pip | >= 2016.11.0, < 2016.11.8 | 2016.11.8 |
| salt | pip | >= 2017.7.0, < 2017.7.2 | 2017.7.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper path validation in minion ID handling. The GitHub commit shows the fix occurred in salt/utils/verify.py's valid_id function, where developers added explicit checks for path separators (/, , \0) and removed the flawed clean_id helper. The original implementation used a regex in clean_id that only checked for '..' followed by the OS path separator, which was an incomplete fix for CVE-2017-12791. The valid_id function's failure to comprehensively block all path separators made it the vulnerable entry point.