CVE-2013-2228

SaltStack RSA Key Generation allows remote users to decrypt communications

8.1 HighFix available

CVE-2013-2228 is a high vulnerability (CVSS 8.1) in Saltstack, published December 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in salt 0.15.1.

SaltStack RSA Key Generation allows remote users to decrypt communications

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.96%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 8.1

SaltStack RSA Key Generation allows remote users to decrypt communications

Record: CVE-2013-2228
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-307
Updated: 2026-11-02

CVE List No score

SaltStack RSA Key Generation allows remote users to decrypt communications

Record: CVE-2013-2228
Updated: 2026-11-02

EUVDEUVD-2022-3990 No score

SaltStack RSA Key Generation allows remote users to decrypt communications

Record: EUVD-2022-3990
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gq26-cpq6-w85r 8.1

SaltStack RSA Key Generation allows remote users to decrypt communications

SaltStack RSA Key Generation allows remote users to decrypt communications

Record: GHSA-gq26-cpq6-w85r
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-307
Updated: 2026-11-02

OSVGHSA-gq26-cpq6-w85r 8.1

SaltStack RSA Key Generation allows remote users to decrypt communications

SaltStack RSA Key Generation allows remote users to decrypt communications

Record: GHSA-gq26-cpq6-w85r
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-307
Updated: 2026-11-02

OSVPYSEC-2026-748 8.1

SaltStack RSA Key Generation allows remote users to decrypt communications

SaltStack RSA Key Generation allows remote users to decrypt communications

Record: PYSEC-2026-748
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

saltstack

Affected packages

Affected packages
Package	Affected	Fixed
`salt` PyPI	before 0.15.1	0.15.1
`salt` PyPI	before 0.15.1, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 25 moreShow less 0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.1	0.15.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less