GitHub Advisoryadvisory · PyPI

GHSA-f2h7-4f84-8qrm SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

HIGH Published 2022-05-17 Modified 2024-10-21 Official page ↗
Aliases
CVE-2017-5192
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2024-04-22

Affected packages

• PyPI salt: < 2015.8.13 → fixed in 2015.8.13 • PyPI salt: >= 2016.3.0, < 2016.3.5 → fixed in 2016.3.5 • PyPI salt: >= 2016.11.0, < 2016.11.2 → fixed in 2016.11.2

Description

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Related

Alias · CVE (1)

  • CVE-2017-5192 When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References