When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before     2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all     authentication to be bypassed. (CVE-2017-5192)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before
    2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all
    authentication to be bypassed. (CVE-2017-5192)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before
    2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all
    authentication to be bypassed. (CVE-2017-5192)

  - Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2
    allows arbitrary command execution on a salt-master via Salt's ssh_client. (CVE-2017-5200)

An update of the salt package has been released.

ID	Name	Product	Family	Type	Severity
260801	Linux Distros Unpatched Vulnerability : CVE-2017-5192	Nessus	Misc.	Local	high
434711	SCA: security update for salt (GHSA-f2h7-4f84-8qrm)	Tenable Cloud Security	SCA Checks	Local	high
434711	SCA: security update for salt (GHSA-f2h7-4f84-8qrm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
407038	Alpine: multiple salt packages: security update to 2016.11.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
407038	Alpine: multiple salt packages: security update to 2016.11.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
121806	Photon OS 1.0: Salt PHSA-2018-1.0-0106	Nessus	PhotonOS Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-5192

high

Tenable Plugins

high

high

high

high

high

critical