An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade salt | Aug 22, 2024 | Apr 30, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 30, 2020 |
| Debian | — | Upgrade salt | May 7, 2020 | Apr 30, 2020 |
| Freebsd | — | Upgrade py37-saltUpgrade py27-saltUpgrade py34-saltUpgrade py38-saltUpgrade py33-saltUpgrade py32-saltUpgrade py36-saltUpgrade py35-salt | May 17, 2020 | May 16, 2020 |
| Saltstack | — | Upgrade SaltStack to the latest version | May 6, 2020 | Apr 30, 2020 |
| Suse | — | Upgrade salt-minionUpgrade salt-apiUpgrade salt-zsh-completionUpgrade salt-cloudUpgrade salt-bash-completionUpgrade salt-masterUpgrade salt-transactional-updateUpgrade python3-distroUpgrade salt-sshUpgrade salt-docUpgrade python2-saltUpgrade salt-proxyUpgrade saltUpgrade python3-saltUpgrade salt-fish-completionUpgrade salt-standalone-formulas-configurationUpgrade salt-syndicUpgrade python-singledispatchUpgrade python2-distro | May 1, 2020 | Apr 30, 2020 |
| Ubuntu | — | Upgrade salt-common (Ubuntu Pro)Upgrade salt-commonUpgrade salt-minion (Ubuntu Pro)Upgrade salt-apiUpgrade salt-masterUpgrade salt-master (Ubuntu Pro)Upgrade salt-minion | Aug 15, 2020 | Apr 30, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 30, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub