GitHub Advisoryadvisory · PyPI

GHSA-v2rp-9cpj-pfw2 Salt Insecure configuration of PAM external authentication service

MEDIUM Published 2022-05-17 Modified 2024-10-21 Official page ↗
Aliases
CVE-2016-3176
Ecosystem
PyPI
Packages
salt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-287
Reviewed
2024-04-29

Affected packages

• PyPI salt: < 2015.5.10 → fixed in 2015.5.10 • PyPI salt: >= 2015.8, < 2015.8.8 → fixed in 2015.8.8

Description

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

Related

Alias · CVE (1)

  • CVE-2016-3176 Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References