{"id":"CVE-2019-17361","aliases":["ALPINE-CVE-2019-17361","DSA-4676-1","EUVD-2020-0176","GHSA-q53j-p6r2-g2v4","PYSEC-2020-177","SUSE-RU-2020:0625-1","SUSE-RU-2020:0685-1","SUSE-SU-2020:0538-1","SUSE-SU-2020:0540-1","SUSE-SU-2020:0684-1","UBUNTU-CVE-2019-17361","USN-4459-1","openSUSE-SU-2020:0357-1","openSUSE-SU-2024:11364-1"],"status":"published","title":"SaltStack Salt is vulnerable to command injection","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.15106,"percentile":0.96779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2020-01-17T01:16:29Z","modified":"2026-11-03T06:31:54Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2019.2.3","2019.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.12","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"salt","fixed_in":["2019.2.3-r0"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"salt","fixed_in":["2015.8.8+ds-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"salt","fixed_in":["2017.7.4+dfsg1-1ubuntu18.04.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.2+ds-1+deb9u3"}]}],"versions":["2016.11.2+ds-1","2016.11.2+ds-1+deb9u1","2016.11.2+ds-1+deb9u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.3.4+dfsg1-6+deb10u1"}]}],"versions":["2018.3.4+dfsg1-6"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.3"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2","2019.2.1","2019.2.2"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.1"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-5.64.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-46.88.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-6.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-6.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-6.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1","0.17.5+ds-1ubuntu0.1~esm1","0.17.5+ds-1ubuntu0.1~esm2","0.17.5+ds-1ubuntu0.1~esm4","0.17.5+ds-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017.7.4+dfsg1-1ubuntu18.04.2"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.8.8+ds-1ubuntu0.1"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017.7.4+dfsg1-1ubuntu18.04.2"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.2.0-lp151.5.12.1"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"saltstack","product":"salt"}],"references":[{"url":"https://github.com/saltstack/salt/commits/master","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4676","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4459-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17361","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4459-1","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2020-177.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q53j-p6r2-g2v4","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17361","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/-2020-625/suse-ru-20200625-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1135656","tags":["report"]},{"url":"https://bugzilla.suse.com/1153611","tags":["report"]},{"url":"https://bugzilla.suse.com/1157465","tags":["report"]},{"url":"https://bugzilla.suse.com/1158940","tags":["report"]},{"url":"https://bugzilla.suse.com/1159118","tags":["report"]},{"url":"https://bugzilla.suse.com/1160931","tags":["report"]},{"url":"https://bugzilla.suse.com/1162327","tags":["report"]},{"url":"https://bugzilla.suse.com/1162504","tags":["report"]},{"url":"https://bugzilla.suse.com/1165425","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18897","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2020-685/suse-ru-20200685-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200538-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1163981","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200540-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200684-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17361","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4459-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11652","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PR2PQ3GKS2PLFHVBID4QWOIOSORFRWDH/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31607","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-17361","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T01:16:29Z","modified":"2024-08-05T01:40:15.336Z","updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2020-0176","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T01:16:29Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-q53j-p6r2-g2v4","title":"SaltStack Salt is vulnerable to command injection","description":"In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2022-05-24T17:06:52Z","modified":"2024-10-22T14:42:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2019-17361","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T02:15:11.493Z","modified":"2026-06-17T02:23:48.583Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"ALPINE-CVE-2019-17361","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T02:15:11.493Z","modified":"2026-11-03T06:31:54.657891398Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-17361","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T02:15:11.493Z","modified":"2026-10-20T10:50:48.695530312Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-q53j-p6r2-g2v4","title":"SaltStack Salt is vulnerable to command injection","description":"In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2022-05-24T17:06:52Z","modified":"2024-10-22T15:16:42.855212Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2019-17361","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T02:15:00Z","modified":"2026-04-08T13:30:31.93588Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DSA-4676-1","title":"salt - security update","status":"published","published":"2020-05-06T00:00:00Z","modified":"2026-03-09T02:10:21.886313Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:0357-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances after\n  running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n  Move token with atomic operation\n  Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n  Adds virt.(pool|network)_get_xml functions\n- Various libvirt updates:\n  * Add virt.pool_capabilities function\n  * virt.pool_running improvements\n  * Add virt.pool_deleted state\n  * virt.network_define allow adding IP configuration\n- virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- xfs: do not fail if type is not present (bsc#1153611)\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Read repo info without using interpolation (bsc#1135656)\n- Limiting M2Crypto to \u003e= SLE15\n- Replacing pycrypto with M2Crypto (bsc#1165425)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-03-18T15:18:47Z","modified":"2026-02-04T03:45:15.939882Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11364-1","title":"python3-salt-3002.2-6.1 on GA media","description":"These are all security issues fixed in the python3-salt-3002.2-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:00.752468Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"PYSEC-2020-177","description":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.","status":"published","published":"2020-01-17T02:15:00Z","modified":"2026-06-10T17:02:38.485784122Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-RU-2020:0625-1","title":"Recommended update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n- Move token with atomic operation\n- Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n- Adds virt.(pool|network)_get_xml functions\n- Virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- Xfs: do not fail if type is not present (bsc#1153611)\n- Don't use __python indirection macros on spec file\n  %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020);\n  additionally, python/python3 are just binaries in the path.\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Prevent test_mod_del_repo_multiline_values to fail\n- Read repo info without using interpolation (bsc#1135656)\n- Replacing pycrypto with M2Crypto as dependency for \u003e= SLE15 (bsc#1165425)\n- Batch Async: Handle exceptions, properly unregister and close instances\n  after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n","status":"published","published":"2020-03-10T09:39:57Z","modified":"2026-02-04T03:37:51.627732Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2020:0685-1","title":"Recommended update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n- Move token with atomic operation\n- Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n- Adds virt.(pool|network)_get_xml functions\n- Virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- Xfs: do not fail if type is not present (bsc#1153611)\n- Don't use __python indirection macros on spec file\n  %__python is no longer defined in RPM 4.15 (python2 is going EOL in Jan 2020);\n  additionally, python/python3 are just binaries in the path.\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Prevent test_mod_del_repo_multiline_values to fail\n- Read repo info without using interpolation (bsc#1135656)\n- Replacing pycrypto with M2Crypto as dependency for \u003e= SLE15 (bsc#1165425)\n- Batch Async: Handle exceptions, properly unregister and close instances\n  after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n","status":"published","published":"2020-03-13T13:13:12Z","modified":"2026-02-04T02:17:17.023436Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2020:0538-1","title":"Security Beta update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Update to Salt version 2019.2.3 (CVE-2019-17361) (bsc#1163981)\n  See release notes: https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html\n- Enable passing grains to start event based on 'start_event_grains' configuration parameter\n\n","status":"published","published":"2020-02-28T12:19:42Z","modified":"2026-02-04T03:51:01.550308Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0540-1","title":"Security Beta update for Salt","description":"\nThis update fixes the following issues:\n\nsalt:\n\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Update to Salt version 2019.2.3 (CVE-2019-17361) (bsc#1163981)\n  See release notes: https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html\n- Enable passing grains to start event based on 'start_event_grains' configuration parameter\n\n","status":"published","published":"2020-02-28T12:20:13Z","modified":"2026-02-04T02:27:00.362164Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0684-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897)\n- Fix unit tests failures in test_batch_async tests\n- Batch Async: Handle exceptions, properly unregister and close instances after\n  running async batching to avoid CPU starvation of the MWorkers (bsc#1162327)\n- RHEL/CentOS 8 uses platform-python instead of python3\n- New configuration option for selection of grains in the minion start event.\n- Fix 'os_family' grain for Astra Linux Common Edition\n- Fix for salt-api NET API where unauthenticated attacker could run\n  arbitrary code (CVE-2019-17361) (bsc#1162504)\n- Adds disabled parameter to mod_repo in aptpkg module\n  Move token with atomic operation\n  Bad API token files get deleted (bsc#1160931)\n- Support for Btrfs and XFS in parted and mkfs added\n- Adds list_downloaded for apt Module to enable pre-downloading support\n  Adds virt.(pool|network)_get_xml functions\n- Various libvirt updates:\n  * Add virt.pool_capabilities function\n  * virt.pool_running improvements\n  * Add virt.pool_deleted state\n  * virt.network_define allow adding IP configuration\n- virt: adding kernel boot parameters to libvirt xml\n- Fix to scheduler when data['run'] does not exist (bsc#1159118)\n- Fix virt states to not fail on VMs already stopped\n- Fix applying of attributes for returner rawfile_json (bsc#1158940)\n- xfs: do not fail if type is not present (bsc#1153611)\n- Fix errors when running virt.get_hypervisor function\n- Align virt.full_info fixes with upstream Salt\n- Fix for log checking in x509 test\n- Read repo info without using interpolation (bsc#1135656)\n- Limiting M2Crypto to \u003e= SLE15\n- Replacing pycrypto with M2Crypto (bsc#1165425)\n","status":"published","published":"2020-03-13T12:42:49Z","modified":"2026-02-04T03:34:11.195793Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4459-1","title":"salt vulnerabilities","description":"It was discovered that Salt allows remote attackers to determine which files\nexist on the server. An attacker could use that to extract sensitive\ninformation. (CVE-2018-15750)\n\nIt was discovered that Salt has a vulnerability that allows an user to bypass\nauthentication. An attacker could use that to extract sensitive information,\nexecute abritrary code or crash the server. (CVE-2018-15751)\n\nIt was discovered that Salt is vulnerable to command injection. This allows\nan unauthenticated attacker with network access to the API endpoint to\nexecute arbitrary code on the salt-api host. (CVE-2019-17361)\n\nIt was discovered that Salt incorrectly validated method calls and\nsanitized paths. A remote attacker could possibly use this issue to access\nsome methods without authentication. (CVE-2020-11651, CVE-2020-11652)\n","status":"published","published":"2020-08-13T21:23:49Z","modified":"2026-04-27T15:48:48.663844237Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}