In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade salt | Aug 22, 2024 | Jan 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 17, 2020 |
| Debian | — | Upgrade salt | May 7, 2020 | Jan 17, 2020 |
| Freebsd | — | Upgrade py27-saltUpgrade py38-saltUpgrade py32-saltUpgrade py33-saltUpgrade py36-saltUpgrade py37-saltUpgrade py34-saltUpgrade py35-salt | Mar 7, 2020 | Mar 7, 2020 |
| Suse | — | Upgrade salt-zsh-completionUpgrade salt-cloudUpgrade saltUpgrade salt-apiUpgrade salt-masterUpgrade salt-standalone-formulas-configurationUpgrade python3-saltUpgrade salt-minionUpgrade salt-syndicUpgrade salt-sshUpgrade salt-bash-completionUpgrade salt-proxyUpgrade salt-fish-completionUpgrade python2-saltUpgrade salt-doc | Mar 11, 2020 | Jan 17, 2020 |
| Ubuntu | — | Upgrade salt-commonUpgrade salt-minionUpgrade salt-apiUpgrade salt-master | Aug 15, 2020 | Jan 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 17, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub