Description
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
| SLES 11 SP4 | salt | 2016.11.4-42.2 | SUSE-SU-2017:1581-1 |
| SLES 11 SP3 | salt | 2016.11.4-42.2 | SUSE-SU-2017:1581-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.0 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
| SUSE Manager Proxy 3.0 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
| SUSE Manager Client Tools 12 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
| SUSE Enterprise Storage 4 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
| SUSE Enterprise Storage 3 | salt | 2016.11.4-45.2 | SUSE-SU-2017:1582-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | >= 2016.11, < 2016.11.4 | 2016.11.4 | GHSA-xcx4-5wq7-g5g7 |
Advisories 2
- SUSE-SU-2017:1581-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1582-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658
- https://github.com/saltstack/salt/issues/40075
- https://github.com/saltstack/salt/pull/40609
- https://bugzilla.suse.com/show_bug.cgi?id=1035912
- 98095 vdb-entry
- https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html