{"id":"CVE-2016-3176","details":"Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.","aliases":["GHSA-v2rp-9cpj-pfw2","PYSEC-2017-33"],"modified":"2026-07-08T12:41:14.074901Z","published":"2017-01-31T19:59:00.183Z","related":["SUSE-SU-2016:0970-1","SUSE-SU-2016:0972-1","SUSE-SU-2016:1343-1"],"references":[{"type":"ADVISORY","url":"https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html"},{"type":"ADVISORY","url":"https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/saltstack/salt","events":[{"introduced":"0"},{"last_affected":"92889db638dc8f5079641dc86d85ce0cb2a7b984"},{"introduced":"34324abe562f6326618e290611a1737714118749"},{"last_affected":"8d84c636cf241237ca5e033beea6e3179e4de7d5"}],"database_specific":{"cpe":["cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.0:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.1:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.2:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.3:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.4:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.5:*:*:*:*:*:*:*","cpe:2.3:a:saltstack:salt:2015.8.7:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"2015.5.9"},{"introduced":"2015.8.0"},{"last_affected":"2015.8.0"},{"introduced":"2015.8.1"},{"last_affected":"2015.8.1"},{"introduced":"2015.8.2"},{"last_affected":"2015.8.2"},{"introduced":"2015.8.3"},{"last_affected":"2015.8.3"},{"introduced":"2015.8.4"},{"last_affected":"2015.8.4"},{"introduced":"2015.8.5"},{"last_affected":"2015.8.5"},{"introduced":"2015.8.7"},{"last_affected":"2015.8.7"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["2015.8.0","2015.8.1","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","v2015.5.9","v2015.8.7","v2015.8.6","v2015.8.5","v2015.8.4","v2015.5.6","v2015.5.8","v2015.8.3","v2015.8.2","v2015.5.7","v2015.8.1","v2015.8.0","v2015.5.5","v2015.5.4","v2015.5.2","v2015.5.3","v2015.5.1","v2015.5","v2015.2","v2015.5.0","v2015.2.0rc2","v2015.2.0rc1","v2014.7","v2014.1","v0.17","v0.16","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.9","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.9","v0.8.7","v0.8.0","v0.7.0","v0.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3176.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}