Every CVE Search/ Get API key

CVE-2020-28243

SaltStack Salt command injection via a crafted process name

7.8 HighPublic exploitFix available

CVE-2020-28243 is a high vulnerability (CVSS 7.8) in Saltstack Salt, published February 26, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.30%, the 91st percentile. Fixed in salt 2015.8.13.

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.30%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
CVE-2020-28243
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-77
Updated
2026-11-02
CVE List No score

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
CVE-2020-28243
Updated
2026-11-02
EUVDEUVD-2021-0235 No score

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
EUVD-2021-0235
Updated
2026-11-03
GitHub AdvisoriesGHSA-phhw-3wc9-8q75 7.8

SaltStack Salt command injection via a crafted process name

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
GHSA-phhw-3wc9-8q75
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-78
Updated
2026-11-02
OSV 7.8

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
CVE-2020-28243
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-phhw-3wc9-8q75 7.8

SaltStack Salt command injection via a crafted process name

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
GHSA-phhw-3wc9-8q75
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-78
Updated
2026-11-02
Show 17 moreShow less
OSVUBUNTU-CVE-2020-28243 7.8

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
UBUNTU-CVE-2020-28243
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2021:0347-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports:
    • Fix virtual network generated DNS XML for SRV records
    • Don't add spicevmc channel to xen VMs
  • virt UEFI fix: virt.update when efi=True

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:0347-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11364-1 No score

python3-salt-3002.2-6.1 on GA media

These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11364-1
Updated
2026-11-02
OSVPYSEC-2021-73 No score

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Record
PYSEC-2021-73
Updated
2026-11-02
OSVSUSE-RU-2021:0632-1 No score

Recommended update for SUSE Manager 4.0.12.1 Release Notes

This update for SUSE Manager 4.0.12.1 Release Notes provides the following additions:

Release notes for SUSE Manager:

  • Revision 4.0.12.1
  • Bugs mentioned bsc#1181550, bsc#1181556, bsc#1181557, bsc#1181558, bsc#1181559, bsc#1181560, bsc#1181561, bsc#1181562, bsc#1181563, bsc#1181564, bsc#1181565, CVE-2021-25281, CVE-2021-25282, CVE-2021-3197, CVE-2021-25283, CVE-2020-28243, CVE-2020-35662, CVE-2021-25284, CVE-2020-28972, CVE-2021-3148, CVE-2021-3144

Release notes for SUSE Manager proxy:

  • Update to 4.0.12.1
  • Bugs mentioned bsc#1181550, bsc#1181556, bsc#1181557, bsc#1181558, bsc#1181559, bsc#1181560, bsc#1181561, bsc#1181562, bsc#1181563, bsc#1181564, bsc#1181565, CVE-2021-25281, CVE-2021-25282, CVE-2021-3197, CVE-2021-25283, CVE-2020-28243, CVE-2020-35662, CVE-2021-25284, CVE-2020-28972, CVE-2021-3148, CVE-2021-3144
Record
SUSE-RU-2021:0632-1
Updated
2026-11-02
OSVSUSE-RU-2021:0633-1 No score

Recommended update for SUSE Manager 4.1.5.1 Release Notes

This update for SUSE Manager 4.1.5.1 Release Notes provides the following additions:

Release notes for SUSE Manager:

  • Revision 4.1.5.1
  • Bugs mentioned bsc#1181550, bsc#1181556, bsc#1181557, bsc#1181558, bsc#1181559, bsc#1181560, bsc#1181561, bsc#1181562, bsc#1181563, bsc#1181564, bsc#1181565, CVE-2021-25281, CVE-2021-25282, CVE-2021-3197, CVE-2021-25283, CVE-2020-28243, CVE-2020-35662, CVE-2021-25284, CVE-2020-28972, CVE-2021-3148, CVE-2021-3144

Release notes for SUSE Manager proxy:

  • Revision 4.1.5.1 bsc#1181550, bsc#1181556, bsc#1181557, bsc#1181558, bsc#1181559, bsc#1181560, bsc#1181561, bsc#1181562, bsc#1181563, bsc#1181564, bsc#1181565, CVE-2021-25281, CVE-2021-25282, CVE-2021-3197, CVE-2021-25283, CVE-2020-28243, CVE-2020-35662, CVE-2021-25284, CVE-2020-28972, CVE-2021-3148, CVE-2021-3144
Record
SUSE-RU-2021:0633-1
Updated
2026-11-02
OSVSUSE-SU-2021:0624-1 No score

Security update for py26-compat-salt

This update for py26-compat-salt fixes the following issues:

  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
Record
SUSE-SU-2021:0624-1
Updated
2026-11-02
OSVSUSE-SU-2021:0626-1 No score

Security update for py26-compat-salt

This update for py26-compat-salt fixes the following issues:

  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
Record
SUSE-SU-2021:0626-1
Updated
2026-11-02
OSVSUSE-SU-2021:0627-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports:
    • Fix virtual network generated DNS XML for SRV records
    • Don't add spicevmc channel to xen VMs
  • virt UEFI fix: virt.update when efi=True
Record
SUSE-SU-2021:0627-1
Updated
2026-11-02
OSVSUSE-SU-2021:0628-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports:
    • Fix virtual network generated DNS XML for SRV records
    • Don't add spicevmc channel to xen VMs
  • virt UEFI fix: virt.update when efi=True
Record
SUSE-SU-2021:0628-1
Updated
2026-11-02
OSVSUSE-SU-2021:0630-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports:
    • Fix virtual network generated DNS XML for SRV records
    • Don't add spicevmc channel to xen VMs
  • virt UEFI fix: virt.update when efi=True
Record
SUSE-SU-2021:0630-1
Updated
2026-11-02
OSVSUSE-SU-2021:0631-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs
  • virt UEFI fix: virt.update when efi=True
Record
SUSE-SU-2021:0631-1
Updated
2026-11-02
OSVSUSE-SU-2021:0914-1 No score

Security Beta update for Salt

This update fixes the following issues:

salt:

  • virt.network_update: handle missing ipv4 netmask attribute
  • Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
  • Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
  • Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
  • Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
  • Always require python-certifi (used by salt.ext.tornado)
  • Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
  • Master can read grains (bsc#1179696)
Record
SUSE-SU-2021:0914-1
Updated
2026-11-02
OSVSUSE-SU-2021:0915-1 No score

Security Beta update for Salt

This update fixes the following issues:

salt:

  • Only require python-certifi for CentOS7
  • Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
  • Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
  • Fix recursion false detection in payload (bsc#1180101)
  • Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
  • Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
  • Always require python-certifi (used by salt.ext.tornado)
  • Exclude SLE 12 from requiring python-certifi
  • Do not crash when unexpected cmd output at listing patches (bsc#1181290)
  • Fix behavior for 'onlyif/unless' when multiple conditions (bsc#1180818)
  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • Virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs
  • Virt UEFI fix: virt.update when efi=True
  • Master can read grains (bsc#1179696)
Record
SUSE-SU-2021:0915-1
Updated
2026-11-02
OSVSUSE-SU-2021:14650-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
Record
SUSE-SU-2021:14650-1
Updated
2026-11-02
OSVSUSE-SU-2021:1690-1 No score

Security Beta update for Salt

This update fixes the following issues:

salt:

  • Update to Salt release version 3002.2 (jsc#ECO-3212)
  • Drop support for Python2. Obsoletes 'python2-salt' package
  • Virt module updates
    • network: handle missing ipv4 netmask attribute
    • more network support
    • PCI/USB host devices passthrough support
  • Set distro requirement to oldest supported version in requirements/base.txt
  • Bring missing part of async batch implementation back
  • Always require python3-distro (bsc#1182293)
  • Remove deprecated warning that breaks minion execution when 'server_id_use_crc' opts is missing
  • Remove msgpack < 1.0.0 from base requirements (bsc#1176293)
  • Msgpack support for version >= 1.0.0 (bsc#1171257)
  • Fix issue parsing errors in ansiblegate state module
  • Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
  • Transactional_update: detect recursion in the executor
  • Add subpackage salt-transactional-update
  • Remove duplicate directories from specfile
  • Improvements on 'ansiblegate' module (bsc#1185092):
    • New methods: ansible.targets / ansible.discover_playbooks
  • Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
  • Regression fix of salt-ssh on processing targets
  • Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281)
  • Add notify beacon for Debian/Ubuntu systems
  • Fix zmq bug that causes salt-call to freeze (bsc#1181368)
  • Add core grains support for AlmaLinux
  • Allow vendor change option with zypper
  • Virt: virtual network backports to Salt 3000
  • Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
  • Only require python-certifi for CentOS7
  • Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
  • Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
  • Fix recursion false detection in payload (bsc#1180101)
  • Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
  • Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
  • Always require python-certifi (used by salt.ext.tornado)
  • Exclude SLE 12 from requiring python-certifi
  • Do not crash when unexpected cmd output at listing patches (bsc#1181290)
  • Fix behavior for 'onlyif/unless' when multiple conditions (bsc#1180818)
  • Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
  • Allow extra_filerefs as sanitized kwargs for SSH client
  • Fix errors with virt.update
  • Fix for multiple for security issues (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144) (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197) (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560) (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
  • Virt: search for grub.xen path
  • Xen spicevmc, DNS SRV records backports: Fix virtual network generated DNS XML for SRV records Don't add spicevmc channel to xen VMs
  • Virt UEFI fix: virt.update when efi=True
  • Revert wrong zypper patch to support vendorchanges flags on pkg.install
Record
SUSE-SU-2021:1690-1
Updated
2026-11-02
OSVUSN-6948-1 No score

salt vulnerabilities

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2020-16846)

It was discovered that Salt incorrectly created certificates with weak file permissions. (CVE-2020-17490)

It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to bypass authentication. (CVE-2020-25592)

It was discovered that Salt incorrectly handled crafted process names. An attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28243)

It was discovered that Salt incorrectly handled validation of SSL/TLS certificates. A remote attacker could possibly use this issue to spoof a trusted entity. (CVE-2020-28972, CVE-2020-35662)

It was discovered that Salt incorrectly handled credential validation. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2021-25281)

It was discovered that Salt incorrectly handled crafted paths. A remote attacker could possibly use this issue to perform directory traversal. (CVE-2021-25282)

It was discovered that Salt incorrectly handled template rendering. A remote attacker could possibly this issue to run arbitrary code. (CVE-2021-25283)

It was discovered that Salt incorrectly handled logging. An attacker could possibly use this issue to discover credentials. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-25284)

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3148)

It was discovered that Salt incorrectly handled input sanitization. A remote attacker could possibly use this issue to run arbitrary commands. (CVE-2021-3197)

Record
USN-6948-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
salt
PyPI
 before 2015.8.13
2015.8.13
salt
PyPI
 2016.3.0 up to 2016.11.5
2016.11.5
salt
PyPI
 2016.11.7 up to 2016.11.10
2016.11.10
salt
PyPI
 2017.5.0 up to 2017.7.8
2017.7.8
salt
PyPI
 2018.2.0 to 2018.3.5 None known
salt
PyPI
 2019.2.0 up to 2019.2.8
2019.2.8
salt
PyPI
 3000 up to 3000.7
3000.7
salt
PyPI
 3001 up to 3001.5
3001.5
salt
PyPI
 3002 up to 3002.3
3002.3
salt
Debian:9
 before 2016.11.2+ds-1+deb9u7, plus listed versions
2016.11.2+ds-12016.11.2+ds-1+deb9u12016.11.2+ds-1+deb9u22016.11.2+ds-1+deb9u32016.11.2+ds-1+deb9u42016.11.2+ds-1+deb9u52016.11.2+ds-1+deb9u6
2016.11.2+ds-1+deb9u7
Show 42 moreShow less
Affected packages
PackageAffectedFixed
salt
PyPI
 before 2015.8.13, plus listed versions
0.10.00.10.10.10.20.10.30.10.4
Show 45 moreShow less
0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3
2015.8.13
salt
PyPI
 2016.3.0 up to 2016.11.5, plus listed versions
2016.11.02016.11.0rc12016.11.0rc22016.11.12016.11.2
Show 10 moreShow less
2016.11.32016.11.42016.3.12016.3.22016.3.32016.3.42016.3.52016.3.62016.3.72016.3.8
2016.11.5
salt
PyPI
 2016.11.7 up to 2016.11.10, plus listed versions
2016.11.82016.11.9
2016.11.10
salt
PyPI
 2017.5.0 up to 2017.7.8, plus listed versions
2017.7.02017.7.0rc12017.7.12017.7.22017.7.3
Show 4 moreShow less
2017.7.42017.7.52017.7.62017.7.7
2017.7.8
salt
PyPI
 2018.2.0 to 2018.3.5, plus listed versions
2018.3.02018.3.0rc12018.3.12018.3.22018.3.32018.3.4
 None known
salt
PyPI
 2019.2.0 up to 2019.2.8, plus listed versions
2019.2.12019.2.22019.2.32019.2.42019.2.52019.2.62019.2.7
2019.2.8
salt
PyPI
 3000 up to 3000.7, plus listed versions
3000.13000.23000.33000.43000.53000.6
3000.7
salt
PyPI
 3001 up to 3001.5, plus listed versions
3001.13001.23001.33001.4
3001.5
salt
PyPI
 3002 up to 3002.3, plus listed versions
3002.13002.2
3002.3
salt
PyPI
 before 2015.8.10, 2015.8.11 up to 2015.8.13, 2016.3.0 up to 2016.3.4, 2016.3.5 up to 2016.3.6, 2016.3.7 up to 2016.3.8, 2016.11.0 up to 2016.11.3, 2016.11.4 up to 2016.11.5, 2016.11.7 up to 2016.11.10, 2017.7.0 up to 2017.7.8, 2018.3.0rc1 up to 2019.2.0rc1, 2019.2.0 up to 2019.2.5, 2019.2.6 up to 2019.2.8, 3000 up to 3000.6, 3001 up to 3001.4, 3002 up to 3002.5, plus listed versions
0.10.00.10.10.10.20.10.30.10.4
Show 45 moreShow less
0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3
2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5
release-notes-susemanager-proxy
SUSE:Manager Proxy 4.0
 before 4.0.12.1-0.16.52.1
4.0.12.1-0.16.52.1
release-notes-susemanager-proxy
SUSE:Manager Retail Branch Server 4.0
 before 4.0.12.1-0.16.52.1
4.0.12.1-0.16.52.1
release-notes-susemanager
SUSE:Manager Server 4.0
 before 4.0.12.1-3.68.1
4.0.12.1-3.68.1
release-notes-susemanager-proxy
SUSE:Manager Proxy 4.1
 before 4.1.5.1-3.26.1
4.1.5.1-3.26.1
release-notes-susemanager-proxy
SUSE:Manager Retail Branch Server 4.1
 before 4.1.5.1-3.26.1
4.1.5.1-3.26.1
release-notes-susemanager
SUSE:Manager Server 4.1
 before 4.1.5.1-3.38.1
4.1.5.1-3.38.1
py26-compat-salt
SUSE:Manager Server Module 4.1
 before 2016.11.10-6.8.1
2016.11.10-6.8.1
py26-compat-salt
SUSE:Manager Server Module 4.0
 before 2016.11.10-10.22.1
2016.11.10-10.22.1
salt
SUSE:Manager Client Tools 12
 before 3000-46.129.1
3000-46.129.1
salt
SUSE:Linux Enterprise Module for Advanced Systems Management 12
 before 3000-46.129.1
3000-46.129.1
salt
SUSE:Linux Enterprise Point of Sale 12 SP2
 before 3000-46.129.1
3000-46.129.1
salt
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 3000-5.106.1
3000-5.106.1
salt
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 3000-5.106.1
3000-5.106.1
salt
SUSE:Linux Enterprise Server 15-LTSS
 before 3000-5.106.1
3000-5.106.1
salt
SUSE:Linux Enterprise Server for SAP Applications 15
 before 3000-5.106.1
3000-5.106.1
salt
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise Module for Python 2 15 SP2
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise Module for Server Applications 15 SP2
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 3000-24.1
3000-24.1
salt
SUSE:Manager Proxy 4.0
 before 3000-24.1
3000-24.1
salt
SUSE:Manager Retail Branch Server 4.0
 before 3000-24.1
3000-24.1
salt
SUSE:Manager Server 4.0
 before 3000-24.1
3000-24.1
salt
SUSE:Enterprise Storage 6
 before 3000-24.1
3000-24.1
salt
SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS
 before 2016.11.10-43.69.1
2016.11.10-43.69.1
salt
SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS
 before 2016.11.10-43.69.1
2016.11.10-43.69.1
salt
Ubuntu:Pro:18.04:LTS
 before 2017.7.4+dfsg1-1ubuntu18.04.2+esm1, plus listed versions
2016.11.5+ds-12016.11.8+dfsg1-12017.7.2+dfsg1-2ubuntu12017.7.3+dfsg1-12017.7.4+dfsg1-12017.7.4+dfsg1-1ubuntu18.04.12017.7.4+dfsg1-1ubuntu18.04.2
2017.7.4+dfsg1-1ubuntu18.04.2+esm1
salt
Ubuntu:Pro:16.04:LTS
 before 2015.8.8+ds-1ubuntu0.1+esm2, plus listed versions
2015.5.3+ds-12015.8.1+ds-22015.8.3+ds-12015.8.3+ds-22015.8.3+ds-3
Show 6 moreShow less
2015.8.5+ds-12015.8.7+ds-12015.8.8+ds-12015.8.8+ds-1ubuntu0.1~esm12015.8.8+ds-1ubuntu0.12015.8.8+ds-1ubuntu0.1+esm1
2015.8.8+ds-1ubuntu0.1+esm2
salt
openSUSE:Leap 15.2
 before 3000-lp152.3.27.1
3000-lp152.3.27.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubstealthcopter/CVE-2020-282432020-12-22

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 95 moreShow less
This page doesn't list everything

Left out here: 155 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open