CVE-2017-5200: High severity SaltStack Salt vulnerability
Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's sshclient.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.11.2 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.3.5 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2015.8.13 - Upgrade
Upgrade
alpine/saltto a version that resolves this vulnerability.Fixed in 2016.11.2-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5200?
CVE-2017-5200 is considered a high severity vulnerability due to its potential for arbitrary command execution on a salt-master.
How do I fix CVE-2017-5200?
To fix CVE-2017-5200, update SaltStack Salt to version 2015.8.13, 2016.3.5, or 2016.11.2.
What versions of SaltStack Salt are affected by CVE-2017-5200?
CVE-2017-5200 affects SaltStack Salt versions before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2.
What type of vulnerability is CVE-2017-5200?
CVE-2017-5200 is categorized as a remote command execution vulnerability.
Who is impacted by CVE-2017-5200?
Organizations using affected versions of SaltStack Salt for configuration management and automation are impacted by CVE-2017-5200.