Saltstack Salt vulnerabilities

• salt project salt CVE-2024-38824 salt advisory CVE-2024-38824 Fix available 9.6 CriticalJune 13, 2025
• salt project salt Salt can cause Git Providers to get wrong data CVE-2023-20898 Fix available 4.2 MediumSeptember 5, 2023
• salt project salt Salt vulnerable to denial of service CVE-2023-20897 Fix available 5.3 MediumSeptember 5, 2023
• saltstack salt Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary... CVE-2021-33226 Fix availableDisputed 9.8 CriticalFebruary 17, 2023
• saltstack salt Salt's PAM auth fails to reject locked accounts CVE-2022-22967 Fix available 8.8 HighJune 22, 2022
• saltstack salt SaltStack Salt Permissions Bypass CVE-2022-22941 Fix available 8.8 HighMarch 29, 2022
• saltstack salt SaltStack Salt Authentication Bypass by Capture-replay CVE-2022-22936 Fix available 8.8 HighMarch 29, 2022
• saltstack salt SaltStack Salt Improper Authentication via Man in the Middle Attack CVE-2022-22935 Fix available 3.7 LowMarch 29, 2022
• saltstack salt SaltStack Improper Verification of Cryptographic Signature CVE-2022-22934 Fix available 8.8 HighMarch 29, 2022
• saltstack salt, fedoraproject fedora +1 more Improper Authentication in SaltStack Salt CVE-2021-22004 Fix available 6.4 MediumSeptember 8, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more Exposure of Resource to Wrong Sphere in salt CVE-2021-21996 Fix available 7.5 HighSeptember 8, 2021
• saltstack salt, fedoraproject fedora +1 more Command Injection in SaltStack Salt CVE-2021-31607 Fix available 7.8 HighApril 23, 2021
• opensuse tumbleweed, saltstack salt, suse linux enterprise server 15 sp 3 +2 more salt-api unauthenticated remote code execution CVE-2021-25315 Fix available 9.8 CriticalMarch 3, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt is vulnerable to shell injection via ProxyCommand argument CVE-2021-3197 Fix available EPSS 71.7% 9.8 CriticalFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt command injection in the Salt-API when using the Salt-SSH client CVE-2021-3148 Fix available 9.8 CriticalFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt eauth tokens can be used once after expiration CVE-2021-3144 Fix available 9.1 CriticalFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod CVE-2021-25284 Fix available 4.4 MediumFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt Server Side Template Injection CVE-2021-25283 Fix available EPSS 10.4% 9.8 CriticalFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt Directory Traversal vulnerability CVE-2021-25282 Public exploitFix available EPSS 92.6% 9.1 CriticalFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt Improper Authentication vulnerability CVE-2021-25281 Public exploitFix available EPSS 72.9% 9.8 CriticalFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt Improper SSL Certificate Validation CVE-2020-35662 Fix available 7.4 HighFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt Improper Certificate Validation CVE-2020-28972 Fix available 5.9 MediumFebruary 26, 2021
• saltstack salt, debian linux, fedoraproject fedora +2 more SaltStack Salt command injection via a crafted process name CVE-2020-28243 Public exploitFix available 7.8 HighFebruary 26, 2021
• saltstack salt, debian linux +1 more SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi CVE-2020-25592 Public exploitFix available EPSS 57.7% 9.8 CriticalNovember 4, 2020
• saltstack salt, debian linux +1 more SaltStack Salt Allows creating certificates with weak file permissions CVE-2020-17490 Fix available 5.5 MediumNovember 4, 2020
• saltstack salt, debian linux, fedoraproject fedora +1 more +3 more SaltStack Salt Command Injection in netapi ssh client CVE-2020-16846 In KEVPublic exploitFix available EPSS 99.6% 9.8 CriticalNovember 4, 2020
• saltstack salt, blackberry workspaces server, canonical ubuntu linux +3 more +5 more SaltStack Salt is vulnerable Arbitrary Directory Access CVE-2020-11652 In KEVPublic exploitFix available EPSS 86.4% 6.5 MediumApril 29, 2020
• saltstack salt, canonical ubuntu linux, debian linux +2 more +4 more SaltStack Salt Unauthenticated Remote Code Execution CVE-2020-11651 In KEVPublic exploitFix available EPSS 96.6% 9.8 CriticalApril 29, 2020
• saltstack salt, canonical ubuntu linux, debian linux +1 more +3 more SaltStack Salt is vulnerable to command injection CVE-2019-17361 Fix available EPSS 15.1% 9.8 CriticalJanuary 17, 2020
• saltstack SaltStack RSA Key Generation allows remote users to decrypt communications CVE-2013-2228 Fix available 8.1 HighDecember 3, 2019
• salt project salt, saltstack salt 2018, salt 2019 +2 more SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function CVE-2019-1010259 Fix available 9.8 CriticalJuly 18, 2019
• saltstack salt SaltStack Salt Remote command execution and incorrect access control when using salt-api CVE-2018-15751 Fix available 9.8 CriticalOctober 24, 2018
• saltstack salt SaltStack Salt Directory Traversal vulnerability in salt-api CVE-2018-15750 Fix available 5.3 MediumOctober 24, 2018
• saltstack salt SaltStack Salt allows compromised salt-minions to impersonate the salt-master CVE-2017-7893 Fix available 9.8 CriticalApril 23, 2018
• saltstack salt SaltStack Salt Denial of Service via a crafted authentication request CVE-2017-14696 Fix available 7.5 HighOctober 24, 2017
• saltstack salt SaltStack Salt Directory traversal vulnerability in minion id validation CVE-2017-14695 Fix available 9.8 CriticalOctober 24, 2017
• saltstack salt 2015 salt leaks git usernames and passwords to the log CVE-2015-6918 Fix available 6.3 MediumOctober 10, 2017
• saltstack salt SaltStack Salt Authentication Bypass when using the local_batch client from salt-api CVE-2017-5192 Fix available 8.8 HighSeptember 26, 2017
• saltstack salt Salt vulnerable to Improper Certificate Validation CVE-2015-4017 Fix available 7.5 HighAugust 25, 2017
• saltstack salt SaltStack Salt Directory traversal vulnerability in minion id validation CVE-2017-12791 Fix available 9.8 CriticalAugust 23, 2017
• saltstack salt 2015 salt password information leaked in debug logs CVE-2015-6941 Fix available 9.8 CriticalAugust 9, 2017
• saltstack salt SaltStack Salt arbitrary command execution in Salt-api via ssh_client CVE-2017-5200 Fix available 8.8 HighJune 16, 2017
• saltstack salt SaltStack Salt Information Exposure CVE-2017-8109 Fix available 7.8 HighApril 25, 2017
• saltstack salt, fedoraproject fedora +1 more SaltStack has insecure /tmp file handling in salt/modules/chef.py CVE-2015-1839 Fix available 5.3 MediumApril 13, 2017
• saltstack salt, fedoraproject fedora +1 more Salt improper handling of tmp files CVE-2015-1838 Fix available 5.3 MediumApril 13, 2017
• saltstack salt Salt allows deleted minions to read or write to minions with the same id CVE-2016-9639 Fix available 9.1 CriticalJanuary 17, 2017
• saltstack salt Salt uses weak permissions on the cache data CVE-2015-8034 Fix available 3.3 LowJuly 28, 2016
• saltstack salt, opensuse leap +1 more Salt Improper Access Control CVE-2016-1866 Fix available 8.1 HighApril 12, 2016
• saltstack salt Salt Insecure configuration of PAM external authentication service CVE-2016-3176 Fix available 5.6 MediumApril 7, 2016
• saltstack salt SaltStack Salt Insecure Temporary File Creation CVE-2014-3563 Fix available 7.2 HighAugust 22, 2014
• Show olderLoading…