CVE catalog

CVE-2017-5200

Security update for Salt

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
3.23% · Oct 25, 2026

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntusaltpro0.16.0-1vulnerable
Ubuntusaltpro0.16.4-2vulnerable
Ubuntusaltpro0.17.1+dfsg-1vulnerable
Ubuntusaltpro0.17.2-1vulnerable
Ubuntusaltpro0.17.2-2vulnerable
Ubuntusaltpro0.17.2-3vulnerable
Ubuntusaltpro0.17.4-1vulnerable
Ubuntusaltpro0.17.4-2vulnerable
Ubuntusaltpro0.17.5-1vulnerable
Ubuntusaltpro0.17.5+ds-1vulnerable
Ubuntusaltpro0.17.5+ds-1ubuntu0.1~esm1vulnerable
Ubuntusaltpro0.17.5+ds-1ubuntu0.1~esm2vulnerable
Ubuntusaltpro0.17.5+ds-1ubuntu0.1~esm4vulnerable
Ubuntusaltpro0.17.5+ds-1ubuntu0.1~esm5vulnerable
Ubuntusaltpro2015.5.3+ds-1vulnerable
Ubuntusaltpro2015.8.1+ds-2vulnerable
Ubuntusaltpro2015.8.3+ds-1vulnerable
Ubuntusaltpro2015.8.3+ds-2vulnerable
Ubuntusaltpro2015.8.3+ds-3vulnerable
Ubuntusaltpro2015.8.5+ds-1vulnerable
Ubuntusaltpro2015.8.7+ds-1vulnerable
Ubuntusaltpro2015.8.8+ds-1vulnerable
Ubuntusaltpro2015.8.8+ds-1ubuntu0.1~esm1vulnerable
Ubuntusaltpro2015.8.8+ds-1ubuntu0.1vulnerable
Ubuntusaltpro2015.8.8+ds-1ubuntu0.1+esm1vulnerable
Ubuntusaltpro2015.8.8+ds-1ubuntu0.1+esm2vulnerable
Susesaltlinux enterprise server 11 sp3-client-tools2016.11.4-42.2fixed
Susesaltlinux enterprise server 11 sp4-client-tools2016.11.4-42.2fixed
Susesaltmanager client tools 122016.11.4-45.2fixed
Susesaltlinux enterprise module for advanced systems management 122016.11.4-45.2fixed
Susesaltlinux enterprise point of sale 12 sp22016.11.4-45.2fixed
Susesaltmanager proxy 3.02016.11.4-45.2fixed
Susesaltmanager server 3.02016.11.4-45.2fixed
Susesaltenterprise storage 32016.11.4-45.2fixed
Susesaltenterprise storage 42016.11.4-45.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Susesaltrpmlinux enterprise server 11 sp3-client-tools2016.11.4-42.2Not reportedSUSE-SU-2017:1581-1Not reported
Susesaltrpmlinux enterprise server 11 sp4-client-tools2016.11.4-42.2Not reportedSUSE-SU-2017:1581-1Not reported
Susesaltrpmmanager client tools 122016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported
Susesaltrpmlinux enterprise module for advanced systems management 122016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported
Susesaltrpmlinux enterprise point of sale 12 sp22016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported
Susesaltrpmmanager proxy 3.02016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported
Susesaltrpmmanager server 3.02016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported
Susesaltrpmenterprise storage 32016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported
Susesaltrpmenterprise storage 42016.11.4-45.2Not reportedSUSE-SU-2017:1582-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]