Lucene search

GoogleOSV:GHSA-F2H7-4F84-8QRM

HistoryMay 17, 2022 - 12:34 a.m.

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

2022-05-1700:34:42

Google

osv.dev

saltstack

local_batch client

authentication

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

58.7%

JSON

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

References

docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html

docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html

docs.saltstack.com/en/latest/topics/releases/2016.11.2.html

github.com/saltstack/salt

nvd.nist.gov/vuln/detail/CVE-2017-5192