Every CVE Search/ Get API key

CVE-2025-22239

CVE-2025-22239 salt advisory

8.1 HighFix available

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.18%Up 0.2 points since Jun 13, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.1

CVE-2025-22239 salt advisory

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
CVE-2025-22239
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-285
Updated
2026-11-02
EUVDEUVD-2025-18251 8.1

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
EUVD-2025-18251
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-c46w-gr7f-jm2p 8.1

Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
GHSA-c46w-gr7f-jm2p
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-285
Updated
2026-11-02
NVD 8.1

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
CVE-2025-22239
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-285
Updated
2026-11-02
OSVGHSA-c46w-gr7f-jm2p 8.1

Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
GHSA-c46w-gr7f-jm2p
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-285
Updated
2026-11-02
OSVPYSEC-2026-1897 8.1

Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
PYSEC-2026-1897
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2025-22239 8.1

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Record
UBUNTU-CVE-2025-22239
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2025:15295-1 No score

python311-salt-3006.0-41.1 on GA media

These are all security issues fixed in the python311-salt-3006.0-41.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15295-1
Updated
2026-11-02
OSVSUSE-EL-9-CLIENT-TOOLS-2025-2499 No score

Security update 5.0.5 for Multi-Linux Manager Salt Bundle

This update fixes the following issues:

venv-salt-minion:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
    • Fixed VIRTUAL_ENV variable in activate file to point to actual path
    • Fixed the bundle path in pyvenv.cfg
    • Prevent tests failures when pygit2 is not present
Record
SUSE-EL-9-CLIENT-TOOLS-2025-2499
Updated
2026-11-02
OSVSUSE-SU-2025:02476-1 No score

Security update 4.3.16 for Multi-Linux Manager Server

This update fixes the following issues:

release-notes-susemanager:

  • Update to SUSE Manager 4.3.16
    • Important Salt Security Update
    • Added support for SUSE Linux Enterprise 15 SP7 as a client using the Salt Bundle
    • CVE Fixed CVE-2025-23392, CVE-2025-23393, CVE-2024-38824, CVE-2025-22239 CVE-2025-22236, CVE-2025-22237, CVE-2024-38825, CVE-2025-22240 CVE-2024-38823, CVE-2025-22241, CVE-2025-22238, CVE-2025-22242 CVE-2024-38822, CVE-2025-46811, CVE-2025-46809
    • Bugs mentioned: bsc#1157520, bsc#1191142, bsc#1209060, bsc#1211373, bsc#1213952 bsc#1216187, bsc#1221031, bsc#1225740, bsc#1230403, bsc#1230908 bsc#1233371, bsc#1234608, bsc#1236635, bsc#1236779, bsc#1236810 bsc#1236877, bsc#1236910, bsc#1237060, bsc#1237082, bsc#1237294 bsc#1237403, bsc#1237581, bsc#1237694, bsc#1237770, bsc#1238922 bsc#1238924, bsc#1239102, bsc#1239154, bsc#1239604, bsc#1239743 bsc#1239826, bsc#1239868, bsc#1239907, bsc#1240038, bsc#1240386 bsc#1240666, bsc#1240842, bsc#1241239, bsc#1241286, bsc#1241455 bsc#1241490, bsc#1242004, bsc#1242030, bsc#1242148, bsc#1242554 bsc#1242911, bsc#1243239, bsc#1243460, bsc#1243724, bsc#1243825 bsc#1244065, bsc#1244290, bsc#1245027, bsc#1245222, bsc#1245368 bsc#1245005, bsc#1246119
Record
SUSE-SU-2025:02476-1
Updated
2026-11-02
OSVSUSE-SU-2025:02491-1 No score

Security update 5.0.5 for Multi-Linux Manager Salt Bundle

This update fixes the following issues:

venv-salt-minion:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
    • Fixed VIRTUAL_ENV variable in activate file to point to actual path
    • Fixed the bundle path in pyvenv.cfg
    • Prevent tests failures when pygit2 is not present
Record
SUSE-SU-2025:02491-1
Updated
2026-11-02
OSVSUSE-SU-2025:02492-1 No score

Security update 5.0.5 for Multi-Linux Manager Salt Bundle

This update fixes the following issues:

venv-salt-minion:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
    • Fixed VIRTUAL_ENV variable in activate file to point to actual path
    • Fixed the bundle path in pyvenv.cfg
    • Prevent tests failures when pygit2 is not present
Record
SUSE-SU-2025:02492-1
Updated
2026-11-02
OSVSUSE-SU-2025:02499-1 No score

Security update 5.0.5 for Multi-Linux Manager Salt Bundle

This update fixes the following issues:

venv-salt-minion:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
    • Fixed VIRTUAL_ENV variable in activate file to point to actual path
    • Fixed the bundle path in pyvenv.cfg
    • Prevent tests failures when pygit2 is not present
Record
SUSE-SU-2025:02499-1
Updated
2026-11-02
OSVSUSE-SU-2025:02500-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
Record
SUSE-SU-2025:02500-1
Updated
2026-11-02
OSVSUSE-SU-2025:02501-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
Record
SUSE-SU-2025:02501-1
Updated
2026-11-02
OSVSUSE-SU-2025:02502-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
Record
SUSE-SU-2025:02502-1
Updated
2026-11-02
OSVSUSE-SU-2025:02534-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
Record
SUSE-SU-2025:02534-1
Updated
2026-11-02
OSVSUSE-SU-2025:20487-1 No score

Security update for salt

This update for salt fixes the following issues:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 edge-case test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
Record
SUSE-SU-2025:20487-1
Updated
2026-11-02
OSVSUSE-SU-2025:20504-1 No score

Security update 5.0.5 for Multi-Linux Manager Client Tools, Salt and Salt Bundle

This update fixes the following issues:

golang-github-prometheus-node_exporter:

  • Security issues fixed:

    • CVE-2025-22870: Prevent a matching of hosts against proxy patterns to improperly treat an IPv6 zone ID as a hostname component (bsc#1238686)

  • Other bugs fixed:

    • Fixed Darwin memory leak
    • pressure: Fix missing IRQ on older kernels

salt, venv-salt-minion:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Added minion_legacy_req_warnings option to avoid noisy warnings
    • Fixed Ubuntu 24.04 edge-case test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
    • Require M2Crypto version 0.44.0 or higher
    • venv-salt-minion: Fixed bundle path in pyvenv.cfg

uyuni-tools:

  • Version 0.1.31-0:

    • Added the info message about End User License Agreement
    • Don't migrate py2*-compat-salt.conf files (bsc#1240626)
    • Check for restorecon before using it (bsc#1240698)
    • Adjust the distro path in cobbler files after migration (bsc#1238929)
    • Added mgradm support ptf podman --pullPolicy flag (bsc#1236877)
    • Support: don't dump files in bound folders (bsc#1243297)
    • Cleanup host supportconfig files (bsc#1242174)
    • During migration, check if backup already exists (bsc#1243105)
    • Removed SHM size limits from all containers (bsc#1243274)
    • Don't migrate /etc/apache2/vhosts.d/cobbler.conf
    • Fixed migration --prepare for autoinstallable distributions (bsc#1243802)
    • Skip instalation if the server is already set up (bsc#1238849)
    • Bumped the default image tag to 5.0.5
Record
SUSE-SU-2025:20504-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
salt
PyPI
 3006.0rc1 up to 3006.12
3006.12
salt
PyPI
 3007.0rc1 up to 3007.4
3007.4
salt
PyPI
 3006.0rc1 up to 3006.12, plus listed versions
3006.03006.0rc23006.0rc33006.13006.10
Show 9 moreShow less
3006.113006.23006.33006.43006.53006.63006.73006.83006.9
3006.12
salt
PyPI
 3007.0rc1 up to 3007.4, plus listed versions
3007.03007.13007.23007.3
3007.4
salt
PyPI
 3006.0rc1 up to 3006.12, 3007.0rc1 up to 3007.4, plus listed versions
3006.03006.0rc23006.0rc33006.13006.10
Show 13 moreShow less
3006.113006.23006.33006.43006.53006.63006.73006.83006.93007.03007.13007.23007.3
3006.123007.4
venv-salt-minion
SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS
 before 3006.0-1.59.1
3006.0-1.59.1
release-notes-susemanager-proxy
SUSE:Manager Proxy 4.3
 before 4.3.16-150400.3.98.1
4.3.16-150400.3.98.1
release-notes-susemanager
SUSE:Manager Server 4.3
 before 4.3.16-150400.3.140.1
4.3.16-150400.3.140.1
venv-salt-minion
SUSE:Manager Client Tools 12
 before 3006.0-3.76.2
3006.0-3.76.2
venv-salt-minion
SUSE:Manager Client Tools 15
 before 3006.0-150000.3.78.1
3006.0-150000.3.78.1
Show 46 moreShow less
Affected packages
PackageAffectedFixed
venv-salt-minion
SUSE:Manager Client Tools for SLE Micro 5
 before 3006.0-150000.3.78.1
3006.0-150000.3.78.1
venv-salt-minion
SUSE:Manager Proxy Module 4.3
 before 3006.0-150000.3.78.1
3006.0-150000.3.78.1
venv-salt-minion
SUSE:Manager Server Module 4.3
 before 3006.0-150000.3.78.1
3006.0-150000.3.78.1
saltbundlepy
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 3.11.11-1.32.1
3.11.11-1.32.1
saltbundlepy-core
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 3.11.11-1.32.1
3.11.11-1.32.1
saltbundlepy-cython
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 0.29.37-1.12.2
0.29.37-1.12.2
saltbundlepy-jinja2
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 3.1.2-1.12.2
3.1.2-1.12.2
saltbundlepy-lxml
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 4.9.4-1.21.1
4.9.4-1.21.1
saltbundlepy-m2crypto
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 0.45.1-1.12.1
0.45.1-1.12.1
saltbundlepy-msgpack
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 1.0.7-1.14.1
1.0.7-1.14.1
saltbundlepy-ply
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 3.11-1.8.1
3.11-1.8.1
saltbundlepy-tornado
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 6.3.2-1.12.2
6.3.2-1.12.2
saltbundlepy-zypp-plugin
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 0.6.5-1.11.1
0.6.5-1.11.1
venv-salt-minion
SUSE:EL-9:Update:Products:SaltBundle:Update
 before 3006.0-1.59.1
3006.0-1.59.1
salt
SUSE:Linux Enterprise Micro 5.3
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Linux Enterprise Micro 5.4
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Manager Proxy 4.3
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Manager Server 4.3
 before 3006.0-150400.8.80.1
3006.0-150400.8.80.1
salt
SUSE:Linux Enterprise Micro 5.5
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise Module for Server Applications 15 SP6
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise Module for Transactional Server 15 SP6
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
openSUSE:Leap 15.6
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt-test
openSUSE:Leap 15.6
 before 3006.0-150500.4.55.1
3006.0-150500.4.55.1
salt
SUSE:Linux Enterprise Module for Systems Management 15 SP7
 before 3006.0-150700.14.5.2
3006.0-150700.14.5.2
salt
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 3006.0-150300.53.94.1
3006.0-150300.53.94.1
salt
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 3006.0-150300.53.94.1
3006.0-150300.53.94.1
salt
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 3006.0-150300.53.94.1
3006.0-150300.53.94.1
salt
SUSE:Linux Enterprise Micro 5.1
 before 3006.0-150300.53.94.1
3006.0-150300.53.94.1
salt
SUSE:Linux Enterprise Micro 5.2
 before 3006.0-150300.53.94.1
3006.0-150300.53.94.1
salt
SUSE:Enterprise Storage 7.1
 before 3006.0-150300.53.94.1
3006.0-150300.53.94.1
salt
SUSE:Linux Micro 6.1
 before 3006.0-slfo.1.1_4.1
3006.0-slfo.1.1_4.1
salt
SUSE:Linux Micro 6.0
 before 3006.0-13.1
3006.0-13.1
salt
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2
Show 9 moreShow less
0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-10.17.5+ds-1ubuntu0.1~esm10.17.5+ds-1ubuntu0.1~esm20.17.5+ds-1ubuntu0.1~esm40.17.5+ds-1ubuntu0.1~esm5
 None known
salt
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2015.5.3+ds-12015.8.1+ds-22015.8.3+ds-12015.8.3+ds-22015.8.3+ds-3
Show 7 moreShow less
2015.8.5+ds-12015.8.7+ds-12015.8.8+ds-12015.8.8+ds-1ubuntu0.1~esm12015.8.8+ds-1ubuntu0.12015.8.8+ds-1ubuntu0.1+esm12015.8.8+ds-1ubuntu0.1+esm2
 None known
salt
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2016.11.5+ds-12016.11.8+dfsg1-12017.7.2+dfsg1-2ubuntu12017.7.3+dfsg1-12017.7.4+dfsg1-12017.7.4+dfsg1-1ubuntu18.04.12017.7.4+dfsg1-1ubuntu18.04.22017.7.4+dfsg1-1ubuntu18.04.2+esm1
 None known
salt
Ubuntu:22.04:LTS
 All versions, plus listed versions
3002.6+dfsg1-43002.7+dfsg1-13004+dfsg1-43004+dfsg1-53004+dfsg1-6ubuntu13004+dfsg1-73004+dfsg1-83004.1+dfsg-2
 None known
salt
openSUSE:Tumbleweed
 before 3006.0-41.1
3006.0-41.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-22239 is a high vulnerability (CVSS 8.1) in Salt Project Salt, published June 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in salt 3006.12.

References

Show 111 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open