CVE-2017-5192

Summary

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Impact & exploitability

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

• NVD record
• https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.htmlAdvisory
• https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.htmlAdvisory
• https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.htmlAdvisory