CVE-2017-5200

CVE-2017-5200 affects SaltStack Salt’s Salt-api via ssh_client, enabling arbitrary command execution on the salt-master. Affected versions include Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2. Mitigation: apply the fixed releases (e.g., Salt 2015.8.13, 2016.3.5,...

CVE-2017-5192

CVE-2017-5192 affects SaltStack Salt where the local_batch client from salt-api does not respect external_auth in certain old branches (Salt before 2015.8.13; 2016.3.x before 2016.3.5; 2016.11.x before 2016.11.2). This enables authentication bypass of remote callers using the local_batch interfac...