Skip to content
OpenAdvisories

Package · Alpine

salt

28 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-3197 EPSS 72%

    SaltStack Salt is vulnerable to shell injection via ProxyCommand argument

    An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2021-3144

    SaltStack Salt eauth tokens can be used once after expiration

    In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

    salt salt Alpine PyPI
  • Critical 9.8
    CVE-2021-3148

    SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

    An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.p…

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-25283 EPSS 10%

    SaltStack Salt Server Side Template Injection

    An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-25281 Public exploit Scanner template EPSS 73%

    SaltStack Salt Improper Authentication vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2021-25282 Public exploit EPSS 93%

    SaltStack Salt Directory Traversal vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2020-25592 Public exploit EPSS 58%

    SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

    In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-11651 Exploited Public exploit EPSS 97%

    SaltStack Salt Unauthenticated Remote Code Execution

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-17361 EPSS 15%

    SaltStack Salt is vulnerable to command injection

    In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2018-15751

    SaltStack Salt Remote command execution and incorrect access control when using salt-api

    SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).

    salt salt salt Ubuntu Alpine PyPI