These release notes are for an old release of Salt. This release might contain known security and other issues that are fixed in the latest release.

# Salt 2015.8.13 Release Notes

Version 2015.8.13 is a bugfix release for 2015.8.0.

## Security Fixes

CVE-2017-5192 local_batch client external authentication not respected

The `LocalClient.cmd_batch()` method client does not accept `external_auth` credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the `root` user.

CVE-2017-5200 Salt-api allows arbitrary command execution on a salt-master via Salt's ssh_client

Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.

We recommend everyone on the 2015.8 branch upgrade to a patched release as soon as possible.