Description
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server 12 | salt-master – ≤ 2019.2.0-46.83.1 | — |
| SUSE | SUSE Linux Enterprise Server 15 | salt-master – ≤ 2019.2.0-6.21.1 | — |
| openSUSE | Factory | salt-master – ≤ 2019.2.2-3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | salt | 2019.2.0-6.24.1 | SUSE-SU-2020:0684-1 |
| SLES 15 | salt | 2019.2.0-5.64.1 | SUSE-SU-2020:1973-1, SUSE-RU-2020:0625-1 |
| SLES 12 | python-singledispatch | 3.4.0.3-1.5.1 | SUSE-SU-2020:1971-1 |
| SLES 12 | salt | 2019.2.0-46.88.1 | SUSE-SU-2020:1971-1, SUSE-RU-2020:0685-1 |
| SLES 2 | salt | 2019.2.0-6.24.1 | SUSE-SU-2020:0684-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | salt | 2019.2.0-5.64.1 | SUSE-SU-2020:1973-1, SUSE-RU-2020:0625-1 |
| SLE HPC 15 | salt | 2019.2.0-5.64.1 | SUSE-SU-2020:1973-1, SUSE-RU-2020:0625-1 |
| SUSE Manager Server 3.2 | python-singledispatch | 3.4.0.3-1.5.1 | SUSE-SU-2020:1971-1 |
| SUSE Manager Server 3.2 | salt | 2019.2.0-46.88.1 | SUSE-SU-2020:1971-1, SUSE-RU-2020:0685-1 |
| SUSE Manager Proxy 3.2 | python-singledispatch | 3.4.0.3-1.5.1 | SUSE-SU-2020:1971-1 |
| SUSE Manager Proxy 3.2 | salt | 2019.2.0-46.88.1 | SUSE-SU-2020:1971-1, SUSE-RU-2020:0685-1 |
| SUSE Manager Client Tools 12 | python-singledispatch | 3.4.0.3-1.5.1 | SUSE-SU-2020:1971-1 |
| SUSE Manager Client Tools 12 | salt | 2019.2.0-46.88.1 | SUSE-SU-2020:1971-1, SUSE-RU-2020:0685-1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | python-singledispatch | 3.4.0.3-1.5.1 | SUSE-SU-2020:1971-1 |
| SUSE Linux Enterprise Point of Sale 12 SP2 | salt | 2019.2.0-46.88.1 | SUSE-SU-2020:1971-1, SUSE-RU-2020:0685-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | salt | 2019.2.0-lp151.5.12.1 | openSUSE-SU-2020:0357-1 |
Advisories 6
- openSUSE-SU-2020:0357-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2020:0625-1 Recommended update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1973-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0684-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1971-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2020:0685-1 Recommended update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026