CVE-2017-5192: High severity SaltStack Salt vulnerability
When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.11.2 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.3.5 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2015.8.13 - Upgrade
Upgrade
alpine/saltto a version that resolves this vulnerability.Fixed in 2016.11.2-r0 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 2015.8.13 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 2016.3.5 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 2016.11.2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5192?
CVE-2017-5192 is considered a critical vulnerability as it allows authentication bypass in SaltStack Salt.
How do I fix CVE-2017-5192?
To fix CVE-2017-5192, upgrade to SaltStack Salt version 2015.8.13, 2016.3.5, or 2016.11.2.
Which versions of SaltStack Salt are affected by CVE-2017-5192?
CVE-2017-5192 affects SaltStack Salt versions prior to 2015.8.13, 2016.3.5, and 2016.11.2.
What will happen if I don't address CVE-2017-5192?
If CVE-2017-5192 is not addressed, unauthorized users may gain control over the SaltStack Salt infrastructure.
Is CVE-2017-5192 related to external authentication?
Yes, CVE-2017-5192 is specifically related to the lack of respect for external authentication in SaltStack Salt.