Description
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | SaltStack Salt | SaltStack Salt prior to 3002.8, 3003.4, 3004.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | salt | No fix yet | — |
| Ubuntu Pro 16.04 LTS | salt | No fix yet | — |
| Ubuntu Pro 14.04 LTS | salt | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | salt | 3002.2-150300.53.10.1 | SUSE-SU-2022:1059-1, SUSE-RU-2022:1391-1 |
| SLES 15 SP2 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SLES 15 SP1 | salt | 3002.2-150100.57.1 | SUSE-SU-2022:1058-1, SUSE-RU-2022:1389-1 |
| SLES 15 | salt | 3002.2-150000.8.41.26.1 | SUSE-SU-2022:1057-1, SUSE-RU-2022:1385-1 |
| SLES 12 | salt | 3000-58.1 | SUSE-SU-2022:1051-1, SUSE-RU-2022:1384-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SLES for SAP 15 SP1 | salt | 3002.2-150100.57.1 | SUSE-SU-2022:1058-1, SUSE-RU-2022:1389-1 |
| SLES for SAP 15 | salt | 3002.2-150000.8.41.26.1 | SUSE-SU-2022:1057-1, SUSE-RU-2022:1385-1 |
| SLE Real Time 15 SP2 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SLE Micro 5.2 | salt | 3002.2-150300.53.16.1 | SUSE-RU-2022:1391-1 |
| SLE Micro 5.1 | salt | 3002.2-150300.53.10.1 | SUSE-SU-2022:1059-1, SUSE-RU-2022:1391-1 |
| SLE Micro 5.0 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SLE HPC 15 SP2 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SLE HPC 15 SP1 | salt | 3002.2-150100.57.1 | SUSE-SU-2022:1058-1, SUSE-RU-2022:1389-1 |
| SLE HPC 15 | salt | 3002.2-150000.8.41.26.1 | SUSE-SU-2022:1057-1, SUSE-RU-2022:1385-1 |
| SUSE Manager Server 4.2 | release-notes-susemanager | 4.2.5.1-150300.3.34.1 | SUSE-SU-2022:1050-1 |
| SUSE Manager Server 4.1 | release-notes-susemanager | 4.1.14.1-150200.3.77.1 | SUSE-SU-2022:1049-1 |
| SUSE Manager Server 4.1 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SUSE Manager Retail Branch Server 4.1 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SUSE Manager Proxy 4.1 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SUSE Manager Client Tools 15 | venv-salt-minion | 3004-150000.3.8.1 | SUSE-FU-2022:2042-1 |
| SUSE Manager Client Tools 12 | salt | 3000-58.1 | SUSE-SU-2022:1051-1, SUSE-RU-2022:1384-1 |
| SUSE Manager Client Tools 12 | venv-salt-minion | 3004-3.8.1 | SUSE-FU-2022:2135-1 |
| SUSE Enterprise Storage 7 | salt | 3002.2-150200.58.1 | SUSE-SU-2022:1060-1, SUSE-RU-2022:1392-1 |
| SUSE Enterprise Storage 6 | salt | 3002.2-150100.57.1 | SUSE-SU-2022:1058-1, SUSE-RU-2022:1389-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | salt | 3002.2-150300.53.10.1 | openSUSE-SU-2022:1059-1, SUSE-RU-2022:1391-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | salt | 3004.1-r0 | — |
| Alpine v3.23 | salt | 3004.1-r0 | — |
| Alpine v3.22 | salt | 3004.1-r0 | — |
| Alpine v3.21 | salt | 3004.1-r0 | — |
| Alpine v3.20 | salt | 3004.1-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | salt | 3004.1-r0 | — |
| Alpine v3.18 | salt | 3004.1-r0 | — |
| Alpine v3.17 | salt | 3004.1-r0 | — |
| Alpine v3.16 | salt | 3004.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | < 3002.8 | 3002.8 | GHSA-qcr3-hr2f-6557 |
| PyPI | salt | >= 3003, < 3003.4 | 3003.4 | GHSA-qcr3-hr2f-6557 |
| PyPI | salt | >= 3004, < 3004.1 | 3004.1 | GHSA-qcr3-hr2f-6557 |
Advisories 16
- SUSE-RU-2022:1385-1 Recommended update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1058-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1049-1 Security update for SUSE Manager 4.1.14.1 Release Notes SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1057-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1050-1 Security update for SUSE Manager 4.2.5.1 Release Notes SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2022:1391-1 Recommended update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2022:1389-1 Recommended update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1051-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-FU-2022:2135-1 Feature update for SUSE Manager Salt Bundle SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2022:1392-1 Recommended update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1059-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2022:1384-1 Recommended update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1060-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:1059-1 Security update for salt SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-FU-2022:2042-1 Feature update for SUSE Manager Salt Bundle SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-2843 SaltStack Salt: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 6, 2023