Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

salt

69 known vulnerabilities (5 critical, 8 high, 12 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
3008.5.0 (Oct 26, 2026): no advisory affects it
Newest unaffected release
3008.5.0 (Oct 26, 2026), the latest release
Advisories
69 · 5 critical, 8 high, 12 medium, 1 low
Weekly downloads
38.5K
Dependents
107
Releases
278 since 0.8.7 (May 19, 2011)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-62349
    Affects 3006.12.0 to 3006.16.0 (3006.17.0 is outside it); 3007.4.0 to 3007.8.0 (3007.9.0 is outside it)
  • CVE-2025-62348
    Affects 0.8.7 to 3006.16.0 (3006.17.0 is outside it)
  • CVE-2024-38824
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22242
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22241
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22240
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22239
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22238
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22237
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2025-22236
    Affects 3006.0.0 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2024-38825
    Affects 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
  • CVE-2023-34049
    Affects 0.8.7 to 3005.3.0 (3005.4.0 is outside it); 3006.0.0rc1 to 3006.3.0 (3006.4.0 is outside it)
Show all 69 advisoriesShow fewer advisories
  • CVE-2024-22232
    Affects 0.8.7 to 3005.4.0 (3005.5.0 is outside it); 3006.0.0 to 3006.5.0 (3006.6.0 is outside it)
  • CVE-2024-22231
    Affects 0.8.7 to 3005.4.0 (3005.5.0 is outside it); 3006.0.0 to 3006.5.0 (3006.6.0 is outside it)
  • CVE-2023-20898
    Affects 0.8.7 to 3005.1.0 (3005.2.0 is outside it); 3006.0.0rc1 to 3006.1.0 (3006.2.0 is outside it)
  • CVE-2023-20897
    Affects 0.8.7 to 3005.1.0 (3005.2.0 is outside it); 3006.0.0rc1 to 3006.1.0 (3006.2.0 is outside it)
  • CVE-2021-33226
    Affects 0.8.7 to 3003.0.0 (3003.1.0 is outside it)
  • CVE-2022-22967
    Affects 0.8.7 to 3002.8.0 (3002.9.0 is outside it); 3003.0.0 to 3003.4.0 (3003.5.0 is outside it); 3004.0.0 to 3004.1.0 (3004.2.0 is outside it)
  • CVE-2022-22941
    Affects 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
  • CVE-2022-22936
    Affects 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
  • CVE-2022-22935
    Affects 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
  • CVE-2022-22934
    Affects 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
  • CVE-2021-22004
    Affects 0.8.7 to 3003.2.0 (3003.3.0 is outside it)
  • CVE-2021-21996
    Affects 0.8.7 to 3003.2.0 (3003.3.0 is outside it)
  • CVE-2021-31607
    Affects 2016.11.0 to 3002.9.0 (3003.0.0rc1 is outside it)
  • CVE-2021-25315
    Affects 0.8.7 to 3002.1.0 (3002.2.0 is outside it)
  • CVE-2021-3197
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2021-3148
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2021-3144
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2021-25284
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2021-25283
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2021-25282
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2021-25281
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2020-35662
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2020-28972
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2020-28243
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
  • CVE-2020-25592
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.4 (2018.3.5 is outside it); 2019.2.0 to 2019.2.6 (2019.2.7 is outside it); 3000.0.0 to 3000.4.0 (3000.5.0 is outside it); 3001.0.0 to 3001.2.0 (3001.3.0 is outside it); 3002.0.0 (3002.1.0 is outside it)
  • CVE-2020-17490
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.4 (2018.3.5 is outside it); 2019.2.0 to 2019.2.5 (2019.2.6 is outside it); 3000.0.0 to 3000.3.0 (3000.4.0 is outside it); 3001.0.0 to 3001.1.0 (3001.2.0 is outside it); 3002.0.0 (3002.1.0 is outside it)
  • CVE-2020-16846
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.4 (2018.3.5 is outside it); 2019.2.0 to 2019.2.5 (2019.2.6 is outside it); 3000.0.0 to 3000.3.0 (3000.4.0 is outside it); 3001.0.0 to 3001.1.0 (3001.2.0 is outside it); 3002.0.0 (3002.1.0 is outside it)
  • CVE-2020-11652
    Affects 0.8.7 to 2019.2.3 (2019.2.4 is outside it); 3000.0.0 to 3000.1.0 (3000.2.0 is outside it)
  • CVE-2020-11651
    Affects 0.8.7 to 2019.2.3 (2019.2.4 is outside it); 3000.0.0 to 3000.1.0 (3000.2.0 is outside it)
  • CVE-2019-17361
    Affects 0.8.7 to 2019.2.2 (2019.2.3 is outside it)
  • CVE-2013-2228
    Affects 0.8.7 to 0.15.0 (0.15.1 is outside it)
  • CVE-2019-1010259
    Affects 0.8.7 to 2018.3.3 (2018.3.4 is outside it)
  • CVE-2018-15751
    Affects 0.8.7 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0 to 2018.3.2 (2018.3.3 is outside it)
  • CVE-2018-15750
    Affects 0.8.7 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0 to 2018.3.2 (2018.3.3 is outside it)
  • CVE-2017-7893
    Affects 0.8.7 to 2016.3.5 (2016.3.6 is outside it)
  • CVE-2017-14696
    Affects 0.8.7 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.7 (2016.11.8 is outside it); 2017.7.0rc1 to 2017.7.1 (2017.7.2 is outside it)
  • CVE-2017-14695
    Affects 0.8.7 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.7 (2016.11.8 is outside it); 2017.7.0rc1 to 2017.7.1 (2017.7.2 is outside it)
  • CVE-2015-6918
    Affects 0.8.7 to 2015.5.4 (2015.5.5 is outside it)
  • CVE-2017-5200
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.4 (2016.3.5 is outside it); 2016.11.0 to 2016.11.1 (2016.11.2 is outside it)
  • CVE-2017-5192
    Affects 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.4 (2016.3.5 is outside it); 2016.11.0 to 2016.11.1 (2016.11.2 is outside it)
  • CVE-2015-4017
    Affects 0.8.7 to 2014.7.5 (2014.7.6 is outside it)
  • CVE-2017-12791
    Affects 0.8.7 to 2016.11.6 (2016.11.7 is outside it); 2017.7.0 (2017.7.1 is outside it)
  • CVE-2015-6941
    Affects 0.8.7 to 0.9.3 (0.9.4 is outside it); 0.9.9 (0.9.9.1 is outside it); 0.10.0 to 0.11.0 (0.11.1 is outside it); 0.12.0 (0.12.1 is outside it); 0.13.0 (0.13.1 is outside it); 0.14.0 (0.14.1 is outside it); 0.15.0 (0.15.1 is outside it); 0.16.0 (0.16.1 is outside it); 0.17.0 (0.17.1 is outside it); 2014.1.0 (2014.1.1 is outside it); 2014.7.0rc1 to 2014.7.6 (2014.7.7 is outside it); 2015.5.0 to 2015.5.5 (2015.5.6 is outside it); 2015.8.0 (2015.8.1 is outside it)
  • CVE-2017-8109
    Affects 2016.11.0 to 2016.11.3 (2016.11.4 is outside it)
  • CVE-2015-1839
    Affects 0.8.7 to 2014.7.3 (2014.7.4 is outside it)
  • CVE-2015-1838
    Affects 0.8.7 to 2014.7.3 (2014.7.4 is outside it)
  • CVE-2016-9639
    Affects 0.8.7 to 2015.8.10 (2015.8.11 is outside it)
  • CVE-2016-3176
    Affects 0.8.7 to 2015.5.9 (2015.5.10 is outside it); 2015.8.0 to 2015.8.7 (2015.8.8 is outside it)
  • CVE-2015-8034
    Affects 0.8.7 to 2015.8.2 (2015.8.3 is outside it)
  • CVE-2016-1866
    Affects 2015.8.0rc1 to 2015.8.3 (2015.8.4 is outside it)
  • CVE-2014-3563
    Affects 0.8.7 to 2014.1.9 (2014.1.10 is outside it)
  • CVE-2013-6617
    Affects 0.11.0 to 0.17.0 (0.17.1 is outside it)
  • CVE-2013-4439
    Affects 0.8.7 to 0.17.0 (0.17.1 is outside it)
  • CVE-2013-4438
    Affects 0.8.7 to 0.17.0 (0.17.1 is outside it)
  • CVE-2013-4437
    Affects 0.17.0 (0.17.1 is outside it)
  • CVE-2013-4436
    Affects 0.17.0 (0.17.1 is outside it)
  • CVE-2013-4435
    Affects 0.15.0 to 0.17.0 (0.17.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 69

  • CVE-2025-62349Medium 6.2

    Salt Master authentication protocol downgrade may enable minion impersonation

    Affected: from 3006.12, fixed in 3006.17; from 3007.4, fixed in 3007.9; from 3006.12, fixed in 3006.17; from 3007.4, fixed in 3007.9.

    Fixed in 3006.17.0 (released Nov 20, 2025, 71 days before disclosure) and 3007.9.0 (released Nov 20, 2025, 71 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt junos module uses an unsafe YAML loader which may allow unintended code execution

    Affected: fixed in 3006.17.

    Fixed in 3006.17.0 (released Nov 20, 2025, 71 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2024-38824Critical 9.6

    CVE-2024-38824 salt advisory

    Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22242Medium 5.6

    CVE-2025-22242 salt advisory

    Affected: from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22241Medium 5.6

    CVE-2025-22241 salt advisory

    Affected: from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22240Medium 6.3

    CVE-2025-22240 salt advisory

    Affected: from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22239 salt advisory

    Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22238Medium 4.2

    CVE-2025-22238 salt advisory

    Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22237Medium 6.7

    CVE-2025-22237 salt advisory

    Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2025-22236 salt advisory

    Affected: from 3007.0, fixed in 3007.4; from 3006.0, fixed in 3006.12; from 3006.0, fixed in 3006.12; from 3007.0, fixed in 3007.4.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2024-38825Medium 6.4

    CVE-2024-38825 Salt Advisory

    Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.

    Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2023-34049Medium 6.7

    Salt security advisory release - 2023-OCT-27

    Affected: fixed in 3005.4; from 3006.0rc1, fixed in 3006.4; fixed in 3005.4; from 3006.0rc1, fixed in 3006.4.

    Fixed in 3005.4.0 (released Oct 27, 2023, 384 days before disclosure) and 3006.4.0 (released Oct 27, 2023, 384 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Specially crafted url can be created which leads to a directory traversal in the salt file server

    Affected: fixed in 3005.5; from 3006.0, fixed in 3006.6; fixed in 3005.5; from 3006.0, fixed in 3006.6.

    Fixed in 3005.5.0 (released Jan 31, 2024, 148 days before disclosure) and 3006.6.0 (released Jan 31, 2024, 148 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2024-22231Medium 5.0

    Syndic cache directory creation is vulnerable to a directory traversal attack

    Affected: fixed in 3005.5; from 3006.0, fixed in 3006.6; fixed in 3005.5; from 3006.0, fixed in 3006.6.

    Fixed in 3005.5.0 (released Jan 31, 2024, 148 days before disclosure) and 3006.6.0 (released Jan 31, 2024, 148 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2023-20898Medium 4.2

    Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or…

    Affected: from 3006.0, fixed in 3006.2; fixed in 3005.2; fixed in 3005.2; from 3006.0rc1, fixed in 3006.2.

    Fixed in 3005.2.0 (released Aug 10, 2023, 26 days before disclosure) and 3006.2.0 (released Aug 10, 2023, 26 days before disclosure).

    The latest release, 3008.5.0, is not affected.

Show all 69 advisoriesShow fewer advisories
  • CVE-2023-20897Medium 5.3

    Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.

    Affected: from 3006.0, fixed in 3006.2; fixed in 3005.2; fixed in 3005.2; from 3006.0rc1, fixed in 3006.2.

    Fixed in 3005.2.0 (released Aug 10, 2023, 26 days before disclosure) and 3006.2.0 (released Aug 10, 2023, 26 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2021-33226Critical 9.8

    Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in…

    Affected: fixed in 3003.1.

    Fixed in 3003.1.0 (released Jun 23, 2021, 604 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2.

    Affected: fixed in 3002.9; from 3003.0, fixed in 3003.5; from 3004.0, fixed in 3004.2.

    Fixed in 3002.9.0 (released Jun 21, 2022, 1 day before disclosure), 3003.5.0 (released Jun 21, 2022, 1 day before disclosure) and 3004.2.0 (released Jun 21, 2022, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

    Affected: fixed in 3002.8; from 3003, fixed in 3003.4; from 3004, fixed in 3004.1.

    Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

    Affected: fixed in 3002.8; from 3003, fixed in 3003.4; from 3004, fixed in 3004.1.

    Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

    Affected: fixed in 3002.8; from 3003, fixed in 3003.4; from 3004, fixed in 3004.1.

    Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

    Affected: fixed in 3002.8; from 3004, fixed in 3004.1; from 3003, fixed in 3003.4.

    Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt before 3003.3.

    Affected: fixed in 3003.3; fixed in 3003.3.

    Fixed in 3003.3.0 (released Sep 2, 2021, 6 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt before 3003.3.

    Affected: fixed in 3003.3; fixed in 3003.3.

    Fixed in 3003.3.0 (released Sep 2, 2021, 6 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege…

    Affected: from 2016.11.0, fixed in 3003rc1; from 2016.11.0, fixed in 3003rc1.

    Fixed in 3003.0.0rc1 (released Mar 8, 2021, 46 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2021-25315Critical 9.8

    salt-api unauthenticated remote code execution

    Affected: fixed in 3002.2.

    Fixed in 3002.2.0 (released Nov 18, 2020, 105 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; from 2019.2.0, fixed in 2019.2.8.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in through SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in through SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.5.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in through SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in through SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always…

    Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • An issue was discovered in SaltStack Salt before 3002.5.

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.7; from 3000.0, fixed in 3000.5; from 3001.0, fixed in 3001.3; from 3002.0, fixed in 3002.1; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1376 days before disclosure), 2016.3.8 (released Oct 9, 2017, 1124 days before disclosure), 2016.11.10 (released Oct 24, 2018, 744 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.6; from 3000, fixed in 3000.4; from 3001, fixed in 3001.2; from 3002, fixed in 3002.1; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1376 days before disclosure), 2016.3.8 (released Oct 9, 2017, 1124 days before disclosure), 2016.11.10 (released Oct 24, 2018, 744 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • CVE-2020-16846Critical 9.8 · KEV

    An issue was discovered in SaltStack Salt through 3002.

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.6; from 3000.0, fixed in 3000.4; from 3001, fixed in 3001.2; from 3002, fixed in 3002.1; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3.

    Fixed in 2015.8.13 (released Jan 30, 2017, 1376 days before disclosure), 2016.3.8 (released Oct 9, 2017, 1124 days before disclosure), 2016.11.10 (released Oct 24, 2018, 744 days before disclosure) and 6 other versions.

    The latest release, 3008.5.0, is not affected.

  • CVE-2020-11652Medium 6.5 · KEV

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.

    Affected: fixed in 2019.2.4; from 3000, fixed in 3000.2; fixed in 2019.2.4; from 3000, fixed in 3000.2.

    Fixed in 2019.2.4 (released Apr 29, 2020, 1 day before disclosure) and 3000.2.0 (released Apr 29, 2020, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • CVE-2020-11651Critical 9.8 · KEV

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.

    Affected: fixed in 2019.2.4; from 3000, fixed in 3000.2; fixed in 2019.2.4; from 3000, fixed in 3000.2.

    Fixed in 2019.2.4 (released Apr 29, 2020, 1 day before disclosure) and 3000.2.0 (released Apr 29, 2020, 1 day before disclosure).

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection.

    Affected: fixed in 2019.2.1; fixed in 2019.2.3.

    Fixed in 2019.2.3 (released Jan 14, 2020, 3 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • SaltStack RSA Key Generation allows remote users to decrypt communications

    Affected: fixed in 0.15.1.

    Fixed in 0.15.1 (released May 8, 2013, 2400 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection.

    Affected: fixed in 2018.3.4; from 2018.3.0, fixed in 2018.3.4.

    Fixed in 2018.3.4 (released Feb 25, 2019, 143 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands…

    Affected: from 2018.3.0, fixed in 2018.3.3; fixed in 2017.7.8; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0, fixed in 2018.3.3; from 2016.11.0, fixed in 2016.11.10.

    Fixed in 2017.7.8 (released Oct 24, 2018, the day of disclosure) and 2018.3.3 (released Oct 24, 2018, the day of disclosure).

    The latest release, 3008.5.0, is not affected.

  • Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to…

    Affected: fixed in 2017.7.8; from 2018.3.0, fixed in 2018.3.3; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0, fixed in 2018.3.3; from 2016.11.0, fixed in 2016.11.10.

    Fixed in 2017.7.8 (released Oct 24, 2018, the day of disclosure) and 2018.3.3 (released Oct 24, 2018, the day of disclosure).

    The latest release, 3008.5.0, is not affected.

  • In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.

    Affected: fixed in 2016.3.6.

    Fixed in 2016.3.6 (released Mar 24, 2017, 395 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of…

    Affected: fixed in 2016.3.8; from 2016.11, fixed in 2016.11.8; from 2017.7, fixed in 2017.7.2; fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.8; from 2017.7.0, fixed in 2017.7.2.

    Fixed in 2016.3.8 (released Oct 9, 2017, 15 days before disclosure), 2016.11.8 (released Oct 9, 2017, 15 days before disclosure) and 2017.7.2 (released Oct 9, 2017, 15 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x…

    Affected: fixed in 2016.3.8; from 2016.11, fixed in 2016.11.8; from 2017.7, fixed in 2017.7.2; fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.8; from 2017.7.0, fixed in 2017.7.2.

    Fixed in 2016.3.8 (released Oct 9, 2017, 15 days before disclosure), 2016.11.8 (released Oct 9, 2017, 15 days before disclosure) and 2017.7.2 (released Oct 9, 2017, 15 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • salt before 2015.5.5 leaks git usernames and passwords to the log.

    Affected: fixed in 2015.5.5; fixed in 2015.5.5.

    Fixed in 2015.5.5 (released Aug 20, 2015, 782 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution…

    Affected: fixed in 2015.8.13; from 2016.3, fixed in 2016.3.5; from 2016.11, fixed in 2016.11.2; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.5; from 2016.11.0, fixed in 2016.11.2.

    Fixed in 2015.8.13 (released Jan 30, 2017, 239 days before disclosure), 2016.3.5 (released Jan 30, 2017, 239 days before disclosure) and 2016.11.2 (released Jan 30, 2017, 239 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before…

    Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.5; from 2016.11.0, fixed in 2016.11.2; fixed in 2015.8.13; from 2016.3, fixed in 2016.3.5; from 2016.11, fixed in 2016.11.2.

    Fixed in 2015.8.13 (released Jan 30, 2017, 239 days before disclosure), 2016.3.5 (released Jan 30, 2017, 239 days before disclosure) and 2016.11.2 (released Jan 30, 2017, 239 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.

    Affected: fixed in 2014.7.6.

    Fixed in 2014.7.6 (released May 18, 2015, 830 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote…

    Affected: fixed in 2016.11.7; from 2017.7, fixed in 2017.7.1; fixed in 2016.11.7; from 2017.7.0, fixed in 2017.7.1.

    Fixed in 2016.11.7 (released Aug 15, 2017, 8 days before disclosure) and 2017.7.1 (released Aug 15, 2017, 8 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in…

    Affected: from 2015.5, fixed in 2015.5.6; from 2015.8, fixed in 2015.8.1; from 2015.5, fixed in 2015.5.6; from 2015.8, fixed in 2015.8.1.

    Fixed in 2015.5.6 (released Oct 13, 2015, 666 days before disclosure) and 2015.8.1 (released Oct 13, 2015, 666 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting…

    Affected: from 2016.11, fixed in 2016.11.4.

    Fixed in 2016.11.4 (released Apr 18, 2017, 7 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

    Affected: fixed in 2014.7.4; fixed in 2014.7.4.

    Fixed in 2014.7.4 (released Mar 30, 2015, 745 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

    Affected: fixed in 2014.7.4; fixed in 2014.7.4.

    Fixed in 2014.7.4 (released Mar 30, 2015, 745 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

    Affected: fixed in 2015.8.11.

    Fixed in 2015.8.11 (released Jul 25, 2016, 197 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured…

    Affected: fixed in 2015.5.10; from 2015.8, fixed in 2015.8.8; fixed in 2015.5.10; from 2015.8, fixed in 2015.8.8.

    Fixed in 2015.5.10 (released Mar 22, 2016, 315 days before disclosure) and 2015.8.8 (released Mar 22, 2016, 315 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive…

    Affected: fixed in 2015.8.3.

    Fixed in 2015.8.3 (released Dec 1, 2015, 426 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute…

    Affected: from 2015.8.0rc1, fixed in 2015.8.4; from 2015.8, fixed in 2015.8.4.

    Fixed in 2015.8.4 (released Jan 28, 2016, 75 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors…

    Affected: fixed in 2014.1.10.

    Fixed in 2014.1.10 (released Aug 1, 2014, 21 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote…

    Affected: from 0.11.0, fixed in 0.17.1.

    Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted…

    Affected: from 0.15.0, fixed in 0.17.1; fixed in 0.17.1.

    Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors.

    Affected: fixed in 0.17.1.

    Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."

    Affected: from 0.17.0, fixed in 0.17.1.

    Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote…

    Affected: from 0.17.0, fixed in 0.17.1.

    Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).

    The latest release, 3008.5.0, is not affected.

  • Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to…

    Affected: from 0.15.0, fixed in 0.17.1.

    Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).

    The latest release, 3008.5.0, is not affected.