There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before
    2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all
    authentication to be bypassed. (CVE-2017-5192)

  - Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2
    allows arbitrary command execution on a salt-master via Salt's ssh_client. (CVE-2017-5200)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before
    2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all
    authentication to be bypassed. (CVE-2017-5192)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 2015.8.13之前的 SaltStack Salt、 2016.3.x 之前的 2016.3.5和 2016.11.x 之前的 2016.11.2中從 salt-api 使用 local_batch 用戶端時未遵循外部驗證進而導致繞過所有驗證。 (CVE-2017-5192)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 2015.8.13之前的 SaltStack Salt、 2016.3.x2016.3.5] 之前的 SaltStack Salt 以及 2016.11.x 之前的 2016.11.2中从 salt-api 使用 local_batch 客户端时未遵守外部认证从而能够绕过所有认证。 (CVE-2017-5192)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 2015.8.13より前の SaltStack Salt、 2016.3.x より前の 2016.3.5、 2016.11.x より前の 2016.11.2の SaltStack Salt において、salt-api から local_batch クライアントを使用する際、外部認証が尊重されず、すべての認証がバイパスされます。CVE-2017-5192

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before     2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all     authentication to be bypassed. (CVE-2017-5192)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the salt package has been released.

ID	Name	Product	Family	Published	Updated	Severity
407038	Alpine: multiple salt packages: security update to 2016.11.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
434711	SCA: security update for salt (GHSA-f2h7-4f84-8qrm)	Tenable Self-Hosted Container Security	SCA Checks	8/19/2025	7/2/2026	high
407038	Alpine: multiple salt packages: security update to 2016.11.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
434711	SCA: security update for salt (GHSA-f2h7-4f84-8qrm)	Tenable Cloud Security	SCA Checks	8/19/2025	7/2/2026	high
260801	Linux Distros 未修補的弱點：CVE-2017-5192	Nessus	Misc.	9/3/2025	7/12/2026	high
260801	Linux Distros 未修补的漏洞：CVE-2017-5192	Nessus	Misc.	9/3/2025	7/12/2026	high
260801	Linux Distros のパッチ未適用の脆弱性: CVE-2017-5192	Nessus	Misc.	9/3/2025	7/12/2026	high
260801	Linux Distros Unpatched Vulnerability : CVE-2017-5192	Nessus	Misc.	9/3/2025	7/12/2026	high
121806	Photon OS 1.0: Salt PHSA-2018-1.0-0106	Nessus	PhotonOS Local Security Checks	2/7/2019	5/24/2022	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

critical