.. _release-3005-5:

=========================
Salt 3005.5 Release Notes
=========================

Version 3005.5 is a CVE security fix release for :ref:`3005 <release-3005>`.

Security
--------

- Fix CVE-2024-22231 by preventing directory traversal when creating syndic cache directory on the master.
- Fix CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.

These vulnerablities were discovered and reported by:
Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (#565)
