An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade salt | Aug 22, 2024 | Apr 30, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 30, 2020 |
| Debian | — | Upgrade salt | May 7, 2020 | Apr 30, 2020 |
| Freebsd | — | Upgrade py36-saltUpgrade py35-saltUpgrade py33-saltUpgrade py37-saltUpgrade py34-saltUpgrade py32-saltUpgrade py38-saltUpgrade py27-salt | May 17, 2020 | May 16, 2020 |
| Saltstack | — | Upgrade SaltStack to the latest version | May 6, 2020 | Apr 30, 2020 |
| Suse | — | Upgrade salt-syndicUpgrade salt-proxyUpgrade salt-transactional-updateUpgrade salt-apiUpgrade salt-sshUpgrade salt-zsh-completionUpgrade python3-distroUpgrade salt-bash-completionUpgrade salt-docUpgrade salt-minionUpgrade salt-masterUpgrade salt-cloudUpgrade python-singledispatchUpgrade python2-saltUpgrade salt-fish-completionUpgrade saltUpgrade python3-saltUpgrade python2-distroUpgrade salt-standalone-formulas-configuration | May 1, 2020 | Apr 30, 2020 |
| Ubuntu | — | Upgrade salt-common (Ubuntu Pro)Upgrade salt-commonUpgrade salt-master (Ubuntu Pro)Upgrade salt-masterUpgrade salt-apiUpgrade salt-minion (Ubuntu Pro)Upgrade salt-minion | Aug 15, 2020 | Apr 30, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 30, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub