CVE-2017-5192: High severity saltstack vulnerability
Published Sep 26, 2017
·Updated
When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.
Affected Software
12 affected componentsFixes available
pip/salt>=2016.11.0<2016.11.2
2016.11.2
pip/salt>=2016.3.0<2016.3.5
2016.3.5
pip/salt<2015.8.13
2015.8.13
SaltStack Salt<=2015.8.12
SaltStack Salt=2016.3.0
SaltStack Salt=2016.3.1
SaltStack Salt=2016.3.2
SaltStack Salt=2016.3.3
SaltStack Salt=2016.3.4
SaltStack Salt=2016.11.0
SaltStack Salt=2016.11.1
SaltStack Salt=2016.11.2
Event History
Sep 26, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·12:34 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-5192?
CVE-2017-5192 is considered a critical vulnerability as it allows authentication bypass in SaltStack Salt.
2
How do I fix CVE-2017-5192?
To fix CVE-2017-5192, upgrade to SaltStack Salt version 2015.8.13, 2016.3.5, or 2016.11.2.
3
Which versions of SaltStack Salt are affected by CVE-2017-5192?
CVE-2017-5192 affects SaltStack Salt versions prior to 2015.8.13, 2016.3.5, and 2016.11.2.
4
What will happen if I don't address CVE-2017-5192?
If CVE-2017-5192 is not addressed, unauthorized users may gain control over the SaltStack Salt infrastructure.
5
Is CVE-2017-5192 related to external authentication?
Yes, CVE-2017-5192 is specifically related to the lack of respect for external authentication in SaltStack Salt.