Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-6948-1 12 CVEs

salt vulnerabilities

Published Aug 8, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Salt incorrectly handled crafted web requests.
A remote attacker could possibly use this issue to run arbitrary
commands. (CVE-2020-16846)

It was discovered that Salt incorrectly created certificates with weak
file permissions. (CVE-2020-17490)

It was discovered that Salt incorrectly handled credential validation.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2020-25592)

It was discovered that Salt incorrectly handled crafted process names.
An attacker could possibly use this issue to run arbitrary commands.
This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28243)

It was discovered that Salt incorrectly handled validation of SSL/TLS
certificates. A remote attacker could possibly use this issue to spoof
a trusted entity. (CVE-2020-28972, CVE-2020-35662)

It was discovered that Salt incorrectly handled credential validation.
A remote attacker could possibly use this issue to run arbitrary code.
(CVE-2021-25281)

It was discovered that Salt incorrectly handled crafted paths. A remote
attacker could possibly use this issue to perform directory traversal.
(CVE-2021-25282)

It was discovered that Salt incorrectly handled template rendering. A
remote attacker could possibly this issue to run arbitrary code.
(CVE-2021-25283)

It was discovered that Salt incorrectly handled logging. An attacker
could possibly use this issue to discover credentials. This issue only
affected Ubuntu 18.04 LTS. (CVE-2021-25284)

It was discovered that Salt incorrectly handled crafted web requests.
A remote attacker could possibly use this issue to run arbitrary
commands. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3148)

It was discovered that Salt incorrectly handled input sanitization.
A remote attacker could possibly use this issue to run arbitrary
commands. (CVE-2021-3197)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS salt 2015.8.8+ds-1ubuntu0.1+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS salt 2017.7.4+dfsg1-1ubuntu18.04.2+esm1

Vulnerabilities 12

  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-25592 Public exploit EPSS 58%

    SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

    In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-25281 Public exploit Scanner template EPSS 73%

    SaltStack Salt Improper Authentication vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-25283 EPSS 10%

    SaltStack Salt Server Side Template Injection

    An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-3148

    SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

    An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.p…

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-3197 EPSS 72%

    SaltStack Salt is vulnerable to shell injection via ProxyCommand argument

    An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2021-25282 Public exploit EPSS 93%

    SaltStack Salt Directory Traversal vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

    salt salt salt Ubuntu Alpine PyPI
  • High 7.8
    CVE-2020-28243 Public exploit

    SaltStack Salt command injection via a crafted process name

    An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blackliste…

    salt salt Ubuntu PyPI
  • High 7.4
    CVE-2020-35662

    SaltStack Salt Improper SSL Certificate Validation

    In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.

    salt salt Ubuntu PyPI
  • Medium 5.9
    CVE-2020-28972

    SaltStack Salt Improper Certificate Validation

    In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.

    salt salt Ubuntu PyPI
  • Medium 5.5
    CVE-2020-17490

    SaltStack Salt Allows creating certificates with weak file permissions

    The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.

    salt salt salt Ubuntu Alpine PyPI
  • Medium 4.4
    CVE-2021-25284

    SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod

    An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

    salt salt salt Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-16846
  • report
    https://ubuntu.com/security/CVE-2020-17490
  • report
    https://ubuntu.com/security/CVE-2020-25592
  • report
    https://ubuntu.com/security/CVE-2020-28243
  • report
    https://ubuntu.com/security/CVE-2020-28972
  • report
    https://ubuntu.com/security/CVE-2020-35662
  • report
    https://ubuntu.com/security/CVE-2021-3148
  • report
    https://ubuntu.com/security/CVE-2021-3197
  • report
    https://ubuntu.com/security/CVE-2021-25281
  • report
    https://ubuntu.com/security/CVE-2021-25282
  • report
    https://ubuntu.com/security/CVE-2021-25283
  • report
    https://ubuntu.com/security/CVE-2021-25284