Skip to content
OpenAdvisories
Critical 1 exploited CVE DLA-2480-1 3 CVEs

salt - security update

Published Dec 4, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 salt 2016.11.2+ds-1+deb9u6

Vulnerabilities 3

  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-25592 Public exploit EPSS 58%

    SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

    In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

    salt salt salt Ubuntu Alpine PyPI
  • Medium 5.5
    CVE-2020-17490

    SaltStack Salt Allows creating certificates with weak file permissions

    The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.

    salt salt salt Ubuntu Alpine PyPI