Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade salt | Jul 30, 2024 | Apr 12, 2016 |
| Freebsd | — | Upgrade py33-saltUpgrade py34-saltUpgrade py35-saltUpgrade py27-saltUpgrade py32-salt | Dec 10, 2025 | Feb 3, 2016 |
| Suse | — | Upgrade salt-bash-completionUpgrade salt-cloudUpgrade saltUpgrade salt-masterUpgrade salt-zsh-completionUpgrade python3-saltUpgrade salt-fish-completionUpgrade salt-proxyUpgrade salt-minionUpgrade salt-syndicUpgrade salt-sshUpgrade salt-docUpgrade salt-apiUpgrade python2-saltUpgrade salt-standalone-formulas-configuration | Apr 12, 2016 | Apr 12, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 12, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub