# salt (PyPI) vulnerabilities

69 known vulnerabilities (5 critical, 8 high, 12 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 3008.5.0 (Oct 26, 2026): no advisory affects it
- Newest unaffected release: 3008.5.0 (Oct 26, 2026), the latest release
- Weekly downloads: 38.5K
- Dependents: 107
- Releases: 278 since 0.8.7 (May 19, 2011)
- Registry: https://pypi.org/project/salt/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2025-62349: 3006.12.0 to 3006.16.0 (3006.17.0 is outside it); 3007.4.0 to 3007.8.0 (3007.9.0 is outside it)
- CVE-2025-62348: 0.8.7 to 3006.16.0 (3006.17.0 is outside it)
- CVE-2024-38824: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22242: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22241: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22240: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22239: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22238: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22237: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2025-22236: 3006.0.0 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2024-38825: 3006.0.0rc1 to 3006.11.0 (3006.12.0 is outside it); 3007.0.0rc1 to 3007.3.0 (3007.4.0 is outside it)
- CVE-2023-34049: 0.8.7 to 3005.3.0 (3005.4.0 is outside it); 3006.0.0rc1 to 3006.3.0 (3006.4.0 is outside it)
- CVE-2024-22232: 0.8.7 to 3005.4.0 (3005.5.0 is outside it); 3006.0.0 to 3006.5.0 (3006.6.0 is outside it)
- CVE-2024-22231: 0.8.7 to 3005.4.0 (3005.5.0 is outside it); 3006.0.0 to 3006.5.0 (3006.6.0 is outside it)
- CVE-2023-20898: 0.8.7 to 3005.1.0 (3005.2.0 is outside it); 3006.0.0rc1 to 3006.1.0 (3006.2.0 is outside it)
- CVE-2023-20897: 0.8.7 to 3005.1.0 (3005.2.0 is outside it); 3006.0.0rc1 to 3006.1.0 (3006.2.0 is outside it)
- CVE-2021-33226: 0.8.7 to 3003.0.0 (3003.1.0 is outside it)
- CVE-2022-22967: 0.8.7 to 3002.8.0 (3002.9.0 is outside it); 3003.0.0 to 3003.4.0 (3003.5.0 is outside it); 3004.0.0 to 3004.1.0 (3004.2.0 is outside it)
- CVE-2022-22941: 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
- CVE-2022-22936: 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
- CVE-2022-22935: 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
- CVE-2022-22934: 0.8.7 to 3002.7.0 (3002.8.0 is outside it); 3003.0.0 to 3003.3.0 (3003.4.0 is outside it); 3004.0.0 (3004.1.0 is outside it)
- CVE-2021-22004: 0.8.7 to 3003.2.0 (3003.3.0 is outside it)
- CVE-2021-21996: 0.8.7 to 3003.2.0 (3003.3.0 is outside it)
- CVE-2021-31607: 2016.11.0 to 3002.9.0 (3003.0.0rc1 is outside it)
- CVE-2021-25315: 0.8.7 to 3002.1.0 (3002.2.0 is outside it)
- CVE-2021-3197: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2021-3148: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2021-3144: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2021-25284: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2021-25283: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2021-25282: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2021-25281: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2020-35662: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2020-28972: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2020-28243: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.11.4 (2016.11.5 is outside it); 2016.11.7 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.5 (2019.2.0rc1 is outside it); 2019.2.0 to 2019.2.7 (2019.2.8 is outside it); 3000.0.0 to 3000.6.0 (3000.7.0 is outside it); 3001.0.0 to 3001.4.0 (3001.5.0 is outside it); 3002.0.0 to 3002.4.0 (3002.5.0 is outside it)
- CVE-2020-25592: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.4 (2018.3.5 is outside it); 2019.2.0 to 2019.2.6 (2019.2.7 is outside it); 3000.0.0 to 3000.4.0 (3000.5.0 is outside it); 3001.0.0 to 3001.2.0 (3001.3.0 is outside it); 3002.0.0 (3002.1.0 is outside it)
- CVE-2020-17490: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.4 (2018.3.5 is outside it); 2019.2.0 to 2019.2.5 (2019.2.6 is outside it); 3000.0.0 to 3000.3.0 (3000.4.0 is outside it); 3001.0.0 to 3001.1.0 (3001.2.0 is outside it); 3002.0.0 (3002.1.0 is outside it)
- CVE-2020-16846: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.9 (2016.11.10 is outside it); 2017.7.0rc1 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0rc1 to 2018.3.4 (2018.3.5 is outside it); 2019.2.0 to 2019.2.5 (2019.2.6 is outside it); 3000.0.0 to 3000.3.0 (3000.4.0 is outside it); 3001.0.0 to 3001.1.0 (3001.2.0 is outside it); 3002.0.0 (3002.1.0 is outside it)
- CVE-2020-11652: 0.8.7 to 2019.2.3 (2019.2.4 is outside it); 3000.0.0 to 3000.1.0 (3000.2.0 is outside it)
- CVE-2020-11651: 0.8.7 to 2019.2.3 (2019.2.4 is outside it); 3000.0.0 to 3000.1.0 (3000.2.0 is outside it)
- CVE-2019-17361: 0.8.7 to 2019.2.2 (2019.2.3 is outside it)
- CVE-2013-2228: 0.8.7 to 0.15.0 (0.15.1 is outside it)
- CVE-2019-1010259: 0.8.7 to 2018.3.3 (2018.3.4 is outside it)
- CVE-2018-15751: 0.8.7 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0 to 2018.3.2 (2018.3.3 is outside it)
- CVE-2018-15750: 0.8.7 to 2017.7.7 (2017.7.8 is outside it); 2018.3.0 to 2018.3.2 (2018.3.3 is outside it)
- CVE-2017-7893: 0.8.7 to 2016.3.5 (2016.3.6 is outside it)
- CVE-2017-14696: 0.8.7 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.7 (2016.11.8 is outside it); 2017.7.0rc1 to 2017.7.1 (2017.7.2 is outside it)
- CVE-2017-14695: 0.8.7 to 2016.3.7 (2016.3.8 is outside it); 2016.11.0 to 2016.11.7 (2016.11.8 is outside it); 2017.7.0rc1 to 2017.7.1 (2017.7.2 is outside it)
- CVE-2015-6918: 0.8.7 to 2015.5.4 (2015.5.5 is outside it)
- CVE-2017-5200: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.4 (2016.3.5 is outside it); 2016.11.0 to 2016.11.1 (2016.11.2 is outside it)
- CVE-2017-5192: 0.8.7 to 2015.8.12 (2015.8.13 is outside it); 2016.3.0 to 2016.3.4 (2016.3.5 is outside it); 2016.11.0 to 2016.11.1 (2016.11.2 is outside it)
- CVE-2015-4017: 0.8.7 to 2014.7.5 (2014.7.6 is outside it)
- CVE-2017-12791: 0.8.7 to 2016.11.6 (2016.11.7 is outside it); 2017.7.0 (2017.7.1 is outside it)
- CVE-2015-6941: 0.8.7 to 0.9.3 (0.9.4 is outside it); 0.9.9 (0.9.9.1 is outside it); 0.10.0 to 0.11.0 (0.11.1 is outside it); 0.12.0 (0.12.1 is outside it); 0.13.0 (0.13.1 is outside it); 0.14.0 (0.14.1 is outside it); 0.15.0 (0.15.1 is outside it); 0.16.0 (0.16.1 is outside it); 0.17.0 (0.17.1 is outside it); 2014.1.0 (2014.1.1 is outside it); 2014.7.0rc1 to 2014.7.6 (2014.7.7 is outside it); 2015.5.0 to 2015.5.5 (2015.5.6 is outside it); 2015.8.0 (2015.8.1 is outside it)
- CVE-2017-8109: 2016.11.0 to 2016.11.3 (2016.11.4 is outside it)
- CVE-2015-1839: 0.8.7 to 2014.7.3 (2014.7.4 is outside it)
- CVE-2015-1838: 0.8.7 to 2014.7.3 (2014.7.4 is outside it)
- CVE-2016-9639: 0.8.7 to 2015.8.10 (2015.8.11 is outside it)
- CVE-2016-3176: 0.8.7 to 2015.5.9 (2015.5.10 is outside it); 2015.8.0 to 2015.8.7 (2015.8.8 is outside it)
- CVE-2015-8034: 0.8.7 to 2015.8.2 (2015.8.3 is outside it)
- CVE-2016-1866: 2015.8.0rc1 to 2015.8.3 (2015.8.4 is outside it)
- CVE-2014-3563: 0.8.7 to 2014.1.9 (2014.1.10 is outside it)
- CVE-2013-6617: 0.11.0 to 0.17.0 (0.17.1 is outside it)
- CVE-2013-4439: 0.8.7 to 0.17.0 (0.17.1 is outside it)
- CVE-2013-4438: 0.8.7 to 0.17.0 (0.17.1 is outside it)
- CVE-2013-4437: 0.17.0 (0.17.1 is outside it)
- CVE-2013-4436: 0.17.0 (0.17.1 is outside it)
- CVE-2013-4435: 0.15.0 to 0.17.0 (0.17.1 is outside it)

## Advisories (69)

### [CVE-2025-62349](https://cve.now/CVE-2025-62349): Salt Master authentication protocol downgrade may enable minion impersonation

- Severity: Medium 6.2
- Published: Jan 30, 2026
- Affected: from 3006.12, fixed in 3006.17; from 3007.4, fixed in 3007.9; from 3006.12, fixed in 3006.17; from 3007.4, fixed in 3007.9.
- Fixed in 3006.17.0 (released Nov 20, 2025, 71 days before disclosure) and 3007.9.0 (released Nov 20, 2025, 71 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-62348](https://cve.now/CVE-2025-62348): Salt junos module uses an unsafe YAML loader which may allow unintended code execution

- Severity: High 7.8
- Published: Jan 30, 2026
- Affected: fixed in 3006.17.
- Fixed in 3006.17.0 (released Nov 20, 2025, 71 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2024-38824](https://cve.now/CVE-2024-38824): CVE-2024-38824 salt advisory

- Severity: Critical 9.6
- Published: Jun 13, 2025
- Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22242](https://cve.now/CVE-2025-22242): CVE-2025-22242 salt advisory

- Severity: Medium 5.6
- Published: Jun 13, 2025
- Affected: from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22241](https://cve.now/CVE-2025-22241): CVE-2025-22241 salt advisory

- Severity: Medium 5.6
- Published: Jun 13, 2025
- Affected: from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22240](https://cve.now/CVE-2025-22240): CVE-2025-22240 salt advisory

- Severity: Medium 6.3
- Published: Jun 13, 2025
- Affected: from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22239](https://cve.now/CVE-2025-22239): CVE-2025-22239 salt advisory

- Severity: High 8.1
- Published: Jun 13, 2025
- Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22238](https://cve.now/CVE-2025-22238): CVE-2025-22238 salt advisory

- Severity: Medium 4.2
- Published: Jun 13, 2025
- Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22237](https://cve.now/CVE-2025-22237): CVE-2025-22237 salt advisory

- Severity: Medium 6.7
- Published: Jun 13, 2025
- Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2025-22236](https://cve.now/CVE-2025-22236): CVE-2025-22236 salt advisory

- Severity: High 8.1
- Published: Jun 13, 2025
- Affected: from 3007.0, fixed in 3007.4; from 3006.0, fixed in 3006.12; from 3006.0, fixed in 3006.12; from 3007.0, fixed in 3007.4.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2024-38825](https://cve.now/CVE-2024-38825): CVE-2024-38825 Salt Advisory

- Severity: Medium 6.4
- Published: Jun 13, 2025
- Affected: from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4; from 3006.0rc1, fixed in 3006.12; from 3007.0rc1, fixed in 3007.4.
- Fixed in 3006.12.0 (released Jun 12, 2025, 1 day before disclosure) and 3007.4.0 (released Jun 12, 2025, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2023-34049](https://cve.now/CVE-2023-34049): Salt security advisory release - 2023-OCT-27

- Severity: Medium 6.7
- Published: Nov 14, 2024
- Affected: fixed in 3005.4; from 3006.0rc1, fixed in 3006.4; fixed in 3005.4; from 3006.0rc1, fixed in 3006.4.
- Fixed in 3005.4.0 (released Oct 27, 2023, 384 days before disclosure) and 3006.4.0 (released Oct 27, 2023, 384 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2024-22232](https://cve.now/CVE-2024-22232): Specially crafted url can be created which leads to a directory traversal in the salt file server

- Severity: High 7.7
- Published: Jun 27, 2024
- Affected: fixed in 3005.5; from 3006.0, fixed in 3006.6; fixed in 3005.5; from 3006.0, fixed in 3006.6.
- Fixed in 3005.5.0 (released Jan 31, 2024, 148 days before disclosure) and 3006.6.0 (released Jan 31, 2024, 148 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2024-22231](https://cve.now/CVE-2024-22231): Syndic cache directory creation is vulnerable to a directory traversal attack

- Severity: Medium 5.0
- Published: Jun 27, 2024
- Affected: fixed in 3005.5; from 3006.0, fixed in 3006.6; fixed in 3005.5; from 3006.0, fixed in 3006.6.
- Fixed in 3005.5.0 (released Jan 31, 2024, 148 days before disclosure) and 3006.6.0 (released Jan 31, 2024, 148 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2023-20898](https://cve.now/CVE-2023-20898): Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or…

- Severity: Medium 4.2
- Published: Sep 5, 2023
- Affected: from 3006.0, fixed in 3006.2; fixed in 3005.2; fixed in 3005.2; from 3006.0rc1, fixed in 3006.2.
- Fixed in 3005.2.0 (released Aug 10, 2023, 26 days before disclosure) and 3006.2.0 (released Aug 10, 2023, 26 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2023-20897](https://cve.now/CVE-2023-20897): Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.

- Severity: Medium 5.3
- Published: Sep 5, 2023
- Affected: from 3006.0, fixed in 3006.2; fixed in 3005.2; fixed in 3005.2; from 3006.0rc1, fixed in 3006.2.
- Fixed in 3005.2.0 (released Aug 10, 2023, 26 days before disclosure) and 3006.2.0 (released Aug 10, 2023, 26 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-33226](https://cve.now/CVE-2021-33226): Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in…

- Severity: Critical 9.8
- Published: Feb 17, 2023
- Affected: fixed in 3003.1.
- Fixed in 3003.1.0 (released Jun 23, 2021, 604 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2022-22967](https://cve.now/CVE-2022-22967): An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2.

- Severity: High 8.8
- Published: Jun 22, 2022
- Affected: fixed in 3002.9; from 3003.0, fixed in 3003.5; from 3004.0, fixed in 3004.2.
- Fixed in 3002.9.0 (released Jun 21, 2022, 1 day before disclosure), 3003.5.0 (released Jun 21, 2022, 1 day before disclosure) and 3004.2.0 (released Jun 21, 2022, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2022-22941](https://cve.now/CVE-2022-22941): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

- Severity: High 8.8
- Published: Mar 29, 2022
- Affected: fixed in 3002.8; from 3003, fixed in 3003.4; from 3004, fixed in 3004.1.
- Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2022-22936](https://cve.now/CVE-2022-22936): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

- Severity: High 8.8
- Published: Mar 29, 2022
- Affected: fixed in 3002.8; from 3003, fixed in 3003.4; from 3004, fixed in 3004.1.
- Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2022-22935](https://cve.now/CVE-2022-22935): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

- Severity: Low 3.7
- Published: Mar 29, 2022
- Affected: fixed in 3002.8; from 3003, fixed in 3003.4; from 3004, fixed in 3004.1.
- Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2022-22934](https://cve.now/CVE-2022-22934): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.

- Severity: Unrated
- Published: Mar 29, 2022
- Affected: fixed in 3002.8; from 3004, fixed in 3004.1; from 3003, fixed in 3003.4.
- Fixed in 3002.8.0 (released Mar 28, 2022, 1 day before disclosure), 3003.4.0 (released Mar 28, 2022, 1 day before disclosure) and 3004.1.0 (released Mar 28, 2022, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-22004](https://cve.now/CVE-2021-22004): An issue was discovered in SaltStack Salt before 3003.3.

- Severity: Unrated
- Published: Sep 8, 2021
- Affected: fixed in 3003.3; fixed in 3003.3.
- Fixed in 3003.3.0 (released Sep 2, 2021, 6 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-21996](https://cve.now/CVE-2021-21996): An issue was discovered in SaltStack Salt before 3003.3.

- Severity: Unrated
- Published: Sep 8, 2021
- Affected: fixed in 3003.3; fixed in 3003.3.
- Fixed in 3003.3.0 (released Sep 2, 2021, 6 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-31607](https://cve.now/CVE-2021-31607): In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege…

- Severity: Unrated
- Published: Apr 23, 2021
- Affected: from 2016.11.0, fixed in 3003rc1; from 2016.11.0, fixed in 3003rc1.
- Fixed in 3003.0.0rc1 (released Mar 8, 2021, 46 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-25315](https://cve.now/CVE-2021-25315): salt-api unauthenticated remote code execution

- Severity: Critical 9.8
- Published: Mar 3, 2021
- Affected: fixed in 3002.2.
- Fixed in 3002.2.0 (released Nov 18, 2020, 105 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-3197](https://cve.now/CVE-2021-3197): An issue was discovered in SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-3148](https://cve.now/CVE-2021-3148): An issue was discovered in SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-3144](https://cve.now/CVE-2021-3144): In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; from 2019.2.0, fixed in 2019.2.8.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-25284](https://cve.now/CVE-2021-25284): An issue was discovered in through SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-25283](https://cve.now/CVE-2021-25283): An issue was discovered in through SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.5.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-25282](https://cve.now/CVE-2021-25282): An issue was discovered in through SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2021-25281](https://cve.now/CVE-2021-25281): An issue was discovered in through SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-35662](https://cve.now/CVE-2020-35662): In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.

- Severity: High 7.4
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-28972](https://cve.now/CVE-2020-28972): In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always…

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-28243](https://cve.now/CVE-2020-28243): An issue was discovered in SaltStack Salt before 3002.5.

- Severity: Unrated
- Published: Feb 27, 2021
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, through 2018.3.5; from 2019.2.0, fixed in 2019.2.8; from 3000, fixed in 3000.7; from 3001, fixed in 3001.5; from 3002, fixed in 3002.3; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.5; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2019.2.0rc1; from 2019.2.0, fixed in 2019.2.5; from 2019.2.6, fixed in 2019.2.8; from 3000, fixed in 3000.6; from 3001, fixed in 3001.4; from 3002, fixed in 3002.5.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1489 days before disclosure), 2016.11.5 (released May 10, 2017, 1389 days before disclosure), 2016.11.10 (released Oct 24, 2018, 857 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-25592](https://cve.now/CVE-2020-25592): In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.

- Severity: Unrated
- Published: Nov 6, 2020
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.7; from 3000.0, fixed in 3000.5; from 3001.0, fixed in 3001.3; from 3002.0, fixed in 3002.1; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1376 days before disclosure), 2016.3.8 (released Oct 9, 2017, 1124 days before disclosure), 2016.11.10 (released Oct 24, 2018, 744 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-17490](https://cve.now/CVE-2020-17490): The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.

- Severity: Unrated
- Published: Nov 6, 2020
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.6; from 3000, fixed in 3000.4; from 3001, fixed in 3001.2; from 3002, fixed in 3002.1; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1376 days before disclosure), 2016.3.8 (released Oct 9, 2017, 1124 days before disclosure), 2016.11.10 (released Oct 24, 2018, 744 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-16846](https://cve.now/CVE-2020-16846): An issue was discovered in SaltStack Salt through 3002.

- Severity: Critical 9.8 · KEV
- Published: Nov 6, 2020
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.10; from 2017.5.0, fixed in 2017.7.8; from 2018.2.0, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.6; from 3000.0, fixed in 3000.4; from 3001, fixed in 3001.2; from 3002, fixed in 3002.1; fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3.
- Fixed in 2015.8.13 (released Jan 30, 2017, 1376 days before disclosure), 2016.3.8 (released Oct 9, 2017, 1124 days before disclosure), 2016.11.10 (released Oct 24, 2018, 744 days before disclosure) and 6 other versions.
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-11652](https://cve.now/CVE-2020-11652): An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.

- Severity: Medium 6.5 · KEV
- Published: Apr 30, 2020
- Affected: fixed in 2019.2.4; from 3000, fixed in 3000.2; fixed in 2019.2.4; from 3000, fixed in 3000.2.
- Fixed in 2019.2.4 (released Apr 29, 2020, 1 day before disclosure) and 3000.2.0 (released Apr 29, 2020, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2020-11651](https://cve.now/CVE-2020-11651): An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.

- Severity: Critical 9.8 · KEV
- Published: Apr 30, 2020
- Affected: fixed in 2019.2.4; from 3000, fixed in 3000.2; fixed in 2019.2.4; from 3000, fixed in 3000.2.
- Fixed in 2019.2.4 (released Apr 29, 2020, 1 day before disclosure) and 3000.2.0 (released Apr 29, 2020, 1 day before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2019-17361](https://cve.now/CVE-2019-17361): In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection.

- Severity: Unrated
- Published: Jan 17, 2020
- Affected: fixed in 2019.2.1; fixed in 2019.2.3.
- Fixed in 2019.2.3 (released Jan 14, 2020, 3 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-2228](https://cve.now/CVE-2013-2228): SaltStack RSA Key Generation allows remote users to decrypt communications

- Severity: Unrated
- Published: Dec 3, 2019
- Affected: fixed in 0.15.1.
- Fixed in 0.15.1 (released May 8, 2013, 2400 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2019-1010259](https://cve.now/CVE-2019-1010259): SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection.

- Severity: Unrated
- Published: Jul 18, 2019
- Affected: fixed in 2018.3.4; from 2018.3.0, fixed in 2018.3.4.
- Fixed in 2018.3.4 (released Feb 25, 2019, 143 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2018-15751](https://cve.now/CVE-2018-15751): SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands…

- Severity: Unrated
- Published: Oct 24, 2018
- Affected: from 2018.3.0, fixed in 2018.3.3; fixed in 2017.7.8; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0, fixed in 2018.3.3; from 2016.11.0, fixed in 2016.11.10.
- Fixed in 2017.7.8 (released Oct 24, 2018, the day of disclosure) and 2018.3.3 (released Oct 24, 2018, the day of disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2018-15750](https://cve.now/CVE-2018-15750): Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to…

- Severity: Unrated
- Published: Oct 24, 2018
- Affected: fixed in 2017.7.8; from 2018.3.0, fixed in 2018.3.3; from 2017.7.0, fixed in 2017.7.8; from 2018.3.0, fixed in 2018.3.3; from 2016.11.0, fixed in 2016.11.10.
- Fixed in 2017.7.8 (released Oct 24, 2018, the day of disclosure) and 2018.3.3 (released Oct 24, 2018, the day of disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-7893](https://cve.now/CVE-2017-7893): In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.

- Severity: Unrated
- Published: Apr 23, 2018
- Affected: fixed in 2016.3.6.
- Fixed in 2016.3.6 (released Mar 24, 2017, 395 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-14696](https://cve.now/CVE-2017-14696): SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of…

- Severity: Unrated
- Published: Oct 24, 2017
- Affected: fixed in 2016.3.8; from 2016.11, fixed in 2016.11.8; from 2017.7, fixed in 2017.7.2; fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.8; from 2017.7.0, fixed in 2017.7.2.
- Fixed in 2016.3.8 (released Oct 9, 2017, 15 days before disclosure), 2016.11.8 (released Oct 9, 2017, 15 days before disclosure) and 2017.7.2 (released Oct 9, 2017, 15 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-14695](https://cve.now/CVE-2017-14695): Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x…

- Severity: Unrated
- Published: Oct 24, 2017
- Affected: fixed in 2016.3.8; from 2016.11, fixed in 2016.11.8; from 2017.7, fixed in 2017.7.2; fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.8; from 2017.7.0, fixed in 2017.7.2.
- Fixed in 2016.3.8 (released Oct 9, 2017, 15 days before disclosure), 2016.11.8 (released Oct 9, 2017, 15 days before disclosure) and 2017.7.2 (released Oct 9, 2017, 15 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2015-6918](https://cve.now/CVE-2015-6918): salt before 2015.5.5 leaks git usernames and passwords to the log.

- Severity: Unrated
- Published: Oct 10, 2017
- Affected: fixed in 2015.5.5; fixed in 2015.5.5.
- Fixed in 2015.5.5 (released Aug 20, 2015, 782 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-5200](https://cve.now/CVE-2017-5200): Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution…

- Severity: Unrated
- Published: Sep 26, 2017
- Affected: fixed in 2015.8.13; from 2016.3, fixed in 2016.3.5; from 2016.11, fixed in 2016.11.2; fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.5; from 2016.11.0, fixed in 2016.11.2.
- Fixed in 2015.8.13 (released Jan 30, 2017, 239 days before disclosure), 2016.3.5 (released Jan 30, 2017, 239 days before disclosure) and 2016.11.2 (released Jan 30, 2017, 239 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-5192](https://cve.now/CVE-2017-5192): When using the local\_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before…

- Severity: Unrated
- Published: Sep 26, 2017
- Affected: fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.5; from 2016.11.0, fixed in 2016.11.2; fixed in 2015.8.13; from 2016.3, fixed in 2016.3.5; from 2016.11, fixed in 2016.11.2.
- Fixed in 2015.8.13 (released Jan 30, 2017, 239 days before disclosure), 2016.3.5 (released Jan 30, 2017, 239 days before disclosure) and 2016.11.2 (released Jan 30, 2017, 239 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2015-4017](https://cve.now/CVE-2015-4017): Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.

- Severity: Unrated
- Published: Aug 25, 2017
- Affected: fixed in 2014.7.6.
- Fixed in 2014.7.6 (released May 18, 2015, 830 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-12791](https://cve.now/CVE-2017-12791): Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote…

- Severity: Unrated
- Published: Aug 23, 2017
- Affected: fixed in 2016.11.7; from 2017.7, fixed in 2017.7.1; fixed in 2016.11.7; from 2017.7.0, fixed in 2017.7.1.
- Fixed in 2016.11.7 (released Aug 15, 2017, 8 days before disclosure) and 2017.7.1 (released Aug 15, 2017, 8 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2015-6941](https://cve.now/CVE-2015-6941): win\_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in…

- Severity: Unrated
- Published: Aug 9, 2017
- Affected: from 2015.5, fixed in 2015.5.6; from 2015.8, fixed in 2015.8.1; from 2015.5, fixed in 2015.5.6; from 2015.8, fixed in 2015.8.1.
- Fixed in 2015.5.6 (released Oct 13, 2015, 666 days before disclosure) and 2015.8.1 (released Oct 13, 2015, 666 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2017-8109](https://cve.now/CVE-2017-8109): The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting…

- Severity: Unrated
- Published: Apr 25, 2017
- Affected: from 2016.11, fixed in 2016.11.4.
- Fixed in 2016.11.4 (released Apr 18, 2017, 7 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2015-1839](https://cve.now/CVE-2015-1839): modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

- Severity: Unrated
- Published: Apr 13, 2017
- Affected: fixed in 2014.7.4; fixed in 2014.7.4.
- Fixed in 2014.7.4 (released Mar 30, 2015, 745 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2015-1838](https://cve.now/CVE-2015-1838): modules/serverdensity\_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

- Severity: Unrated
- Published: Apr 13, 2017
- Affected: fixed in 2014.7.4; fixed in 2014.7.4.
- Fixed in 2014.7.4 (released Mar 30, 2015, 745 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2016-9639](https://cve.now/CVE-2016-9639): Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

- Severity: Unrated
- Published: Feb 7, 2017
- Affected: fixed in 2015.8.11.
- Fixed in 2015.8.11 (released Jul 25, 2016, 197 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2016-3176](https://cve.now/CVE-2016-3176): Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured…

- Severity: Unrated
- Published: Jan 31, 2017
- Affected: fixed in 2015.5.10; from 2015.8, fixed in 2015.8.8; fixed in 2015.5.10; from 2015.8, fixed in 2015.8.8.
- Fixed in 2015.5.10 (released Mar 22, 2016, 315 days before disclosure) and 2015.8.8 (released Mar 22, 2016, 315 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2015-8034](https://cve.now/CVE-2015-8034): The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive…

- Severity: Unrated
- Published: Jan 30, 2017
- Affected: fixed in 2015.8.3.
- Fixed in 2015.8.3 (released Dec 1, 2015, 426 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2016-1866](https://cve.now/CVE-2016-1866): Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute…

- Severity: Unrated
- Published: Apr 12, 2016
- Affected: from 2015.8.0rc1, fixed in 2015.8.4; from 2015.8, fixed in 2015.8.4.
- Fixed in 2015.8.4 (released Jan 28, 2016, 75 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2014-3563](https://cve.now/CVE-2014-3563): Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors…

- Severity: Unrated
- Published: Aug 22, 2014
- Affected: fixed in 2014.1.10.
- Fixed in 2014.1.10 (released Aug 1, 2014, 21 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-6617](https://cve.now/CVE-2013-6617): The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote…

- Severity: Unrated
- Published: Nov 5, 2013
- Affected: from 0.11.0, fixed in 0.17.1.
- Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-4439](https://cve.now/CVE-2013-4439): Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted…

- Severity: Unrated
- Published: Nov 5, 2013
- Affected: from 0.15.0, fixed in 0.17.1; fixed in 0.17.1.
- Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-4438](https://cve.now/CVE-2013-4438): Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors.

- Severity: Unrated
- Published: Nov 5, 2013
- Affected: fixed in 0.17.1.
- Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-4437](https://cve.now/CVE-2013-4437): Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."

- Severity: Unrated
- Published: Nov 5, 2013
- Affected: from 0.17.0, fixed in 0.17.1.
- Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-4436](https://cve.now/CVE-2013-4436): The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote…

- Severity: Unrated
- Published: Nov 5, 2013
- Affected: from 0.17.0, fixed in 0.17.1.
- Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).
- The latest release, 3008.5.0, is not affected.

### [CVE-2013-4435](https://cve.now/CVE-2013-4435): Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to…

- Severity: Unrated
- Published: Nov 5, 2013
- Affected: from 0.15.0, fixed in 0.17.1.
- Fixed in 0.17.1 (released Oct 17, 2013, 19 days before disclosure).
- The latest release, 3008.5.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/salt
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.