CVE-2024-22232

Advisory

Salt version 3005.5 implements a fix to block directory traversal attempts when establishing the syndic cache directory on the master, addressing the security issue outlined in CVE-2024-22231.
https://github.com/saltstack/salt/commit/67bdf8b2ec4bc396a7226d57565b8a05eaec1e88

Affected package

Affected versions

Fixed versions

Vulnerability changelog

========================

Security
--------

- Fix CVE-2024-22231 Prevent directory traversal when creating syndic cache directory on the master.
- Fix CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.

These vulnerablities were discovered and reported by:
Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (565)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22231
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22232