Description
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | salt | 2016.11.2+ds-1+deb9u5 | DLA-2294-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | salt | 2017.7.4+dfsg1-1ubuntu18.04.2 | USN-4459-1 |
| Ubuntu 16.04 LTS | salt | 2015.8.8+ds-1ubuntu0.1 | USN-4459-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | salt | 2015.8.8+ds-1ubuntu0.1+esm1 | USN-4769-1 |
| Ubuntu Pro 14.04 LTS | salt | 0.17.5+ds-1ubuntu0.1~esm1 | USN-4769-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | python-distro | 1.5.0-3.5.1 | SUSE-SU-2021:2106-1 |
| SLES 15 SP2 | python-distro | 1.5.0-3.5.1 | SUSE-SU-2021:2106-1 |
| SLES 15 SP2 | salt | 3002.2-37.1 | SUSE-SU-2021:2106-1 |
| SLES 15 SP1 | salt | 3000-6.37.1 | SUSE-SU-2021:2105-1, SUSE-SU-2020:1974-1 |
| SLES 15 | salt | 2018.3.0-5.20.1 | SUSE-SU-2018:3815-1 |
| SLES 12 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | salt | 2016.11.10-43.38.1 | SUSE-SU-2018:3813-1 |
| SLES 11 SP3 | salt | 2016.11.10-43.38.1 | SUSE-SU-2018:3813-1 |
| SLES 2 | python-distro | 1.5.0-3.5.1 | SUSE-SU-2021:2106-1 |
| SLES 2 | salt | 3000-6.37.1 | SUSE-SU-2020:1974-1 |
| SLES for SAP 15 SP1 | salt | 3002.2-37.1 | SUSE-SU-2021:2105-1 |
| SLE Micro 5.0 | python-distro | 1.5.0-3.5.1 | SUSE-SU-2021:2106-1 |
| SLE Micro 5.0 | salt | 3002.2-37.1 | SUSE-SU-2021:2106-1 |
| SLE HPC 15 SP1 | salt | 3002.2-37.1 | SUSE-SU-2021:2105-1 |
| SUSE Manager Server 4.0 | salt | 3002.2-37.1 | SUSE-SU-2021:2105-1 |
| SUSE Manager Server 3.2 | py26-compat-salt | 2016.11.10-6.15.1 | SUSE-SU-2018:3816-1 |
| SUSE Manager Server 3.2 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Manager Server 3.1 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Manager Server 3.0 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Manager Retail Branch Server 4.0 | salt | 3002.2-37.1 | SUSE-SU-2021:2105-1 |
| SUSE Manager Proxy 4.0 | salt | 3002.2-37.1 | SUSE-SU-2021:2105-1 |
| SUSE Manager Proxy 3.2 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Manager Proxy 3.1 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Manager Proxy 3.0 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Manager Client Tools 12 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | salt | 2018.3.0-46.44.1 | SUSE-SU-2018:3862-1 |
| SUSE Enterprise Storage 6 | salt | 3002.2-37.1 | SUSE-SU-2021:2105-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | python-distro | 1.5.0-3.5.1 | openSUSE-SU-2021:2106-1 |
| openSUSE Leap 15.2 | salt | 3002.2-lp152.3.36.1 | openSUSE-SU-2021:0899-1 |
| openSUSE Leap 15.1 | salt | 3000-lp151.5.21.1 | openSUSE-SU-2020:1074-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.8 | salt | 2018.3.3-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | >= 2017.7.0, < 2017.7.8 | 2017.7.8 | GHSA-x549-r7m8-gv63 |
| PyPI | salt | >= 2018.3.0, < 2018.3.3 | 2018.3.3 | GHSA-x549-r7m8-gv63 |
| PyPI | salt | >= 2016.11.0, < 2016.11.10 | 2016.11.10 | GHSA-x549-r7m8-gv63 |
| PyPI | salt | >= 2018.3.0, < 2018.3.3 · < 2017.7.8 | 2018.3.3, 2017.7.8 | PYSEC-2018-30 |
Advisories 13
- USN-4769-1 salt vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-4459-1 salt vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2294-1 salt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:3815-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1074-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2106-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1974-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3813-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2106-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0899-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3862-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2105-1 Security update for salt SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2018:3816-1 Security update for py26-compat-salt SUSE / openSUSE Security Updates · May 2, 2025
References
- https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
- https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html
- [salt-users] 20181024 2018.3.3 Released - Security Advisory mailing-list
- [salt-users] 20181024 2017.7.8 Released - Security Advisory mailing-list
- openSUSE-SU-2020:1074 vendor-advisory
- [debian-lts-announce] 20200728 [SECURITY] [DLA 2294-1] salt security update mailing-list
- USN-4459-1 vendor-advisory