salt (PyPI)
Advisories
297
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3007.9 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "salt>=3007.9"poetry
poetry add "salt>=3007.9"uv
uv add "salt>=3007.9"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vcf3-26xf-fw4m Salt Authentication Protocol Version Downgrade Allows Minion Impersonation |
Medium EPSS 0.46% |
>= 3006.12, < 3006.17>= 3007.4, < 3007.9 | 3006.173007.9 |
| GHSA-vcf3-26xf-fw4m Salt Authentication Protocol Version Downgrade Allows Minion Impersonation |
Medium EPSS 0.46% |
>= 3007.4, < 3007.9 | 3007.9 |
| GHSA-vcf3-26xf-fw4m Salt Authentication Protocol Version Downgrade Allows Minion Impersonation |
Medium EPSS 0.46% |
>= 3006.12, < 3006.17 | 3006.17 |
| GHSA-77w2-v593-vxvv Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload |
High EPSS 0.20% |
< 3006.17 | 3006.17 |
| GHSA-77w2-v593-vxvv Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload |
High EPSS 0.20% |
< 3006.17 | 3006.17 |
| GHSA-8pcp-r83j-fc92 Salt vulnerable to directory traversal attack in file receiving method |
High EPSS 1.03% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-8pcp-r83j-fc92 Salt vulnerable to directory traversal attack in file receiving method |
High EPSS 1.03% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-8pcp-r83j-fc92 Salt vulnerable to directory traversal attack in file receiving method |
High EPSS 1.03% |
>= 3006.0rc1, < 3006.12>= 3007.0rc1, < 3007.4 | 3006.123007.4 |
| GHSA-989c-m532-p2hv Salt's worker process vulnerable to denial of service through file read operation |
Medium EPSS 0.14% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-989c-m532-p2hv Salt's worker process vulnerable to denial of service through file read operation |
Medium EPSS 0.14% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-989c-m532-p2hv Salt's worker process vulnerable to denial of service through file read operation |
Medium EPSS 0.14% |
>= 3007.0rc1, < 3007.4>= 3006.0rc1, < 3006.12 | 3006.123007.4 |
| GHSA-7f3f-x5f5-79gw Salt's file contents overwrite the VirtKey class |
Medium EPSS 0.18% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-7f3f-x5f5-79gw Salt's file contents overwrite the VirtKey class |
Medium EPSS 0.18% |
>= 3007.0rc1, < 3007.4>= 3006.0rc1, < 3006.12 | 3006.123007.4 |
| GHSA-7f3f-x5f5-79gw Salt's file contents overwrite the VirtKey class |
Medium EPSS 0.18% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-xh32-3m67-qjgf Salt allows arbitrary directory creation or file deletion |
Medium EPSS 0.16% |
>= 3006.0rc1, < 3006.12>= 3007.0rc1, < 3007.4 | 3006.123007.4 |
| GHSA-xh32-3m67-qjgf Salt allows arbitrary directory creation or file deletion |
Medium EPSS 0.16% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-xh32-3m67-qjgf Salt allows arbitrary directory creation or file deletion |
Medium EPSS 0.16% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-c46w-gr7f-jm2p Salt vulnerable to arbitrary event injection |
High EPSS 0.18% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-c46w-gr7f-jm2p Salt vulnerable to arbitrary event injection |
High EPSS 0.18% |
>= 3006.0rc1, < 3006.12>= 3007.0rc1, < 3007.4 | 3006.123007.4 |
| GHSA-c46w-gr7f-jm2p Salt vulnerable to arbitrary event injection |
High EPSS 0.18% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-r546-h3ff-q585 Salt vulnerable to directory traversal attack in minion file cache creation |
Medium EPSS 0.29% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-r546-h3ff-q585 Salt vulnerable to directory traversal attack in minion file cache creation |
Medium EPSS 0.29% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-r546-h3ff-q585 Salt vulnerable to directory traversal attack in minion file cache creation |
Medium EPSS 0.29% |
>= 3006.0rc1, < 3006.12>= 3007.0rc1, < 3007.4 | 3006.123007.4 |
| GHSA-fcr4-h6c4-rvvp Salt's on demand pillar functionality vulnerable to arbitrary command injections |
Medium EPSS 0.18% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-fcr4-h6c4-rvvp Salt's on demand pillar functionality vulnerable to arbitrary command injections |
Medium EPSS 0.18% |
>= 3006.0rc1, < 3006.12>= 3007.0rc1, < 3007.4 | 3006.123007.4 |
| GHSA-fcr4-h6c4-rvvp Salt's on demand pillar functionality vulnerable to arbitrary command injections |
Medium EPSS 0.18% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-jh7c-xh74-h76f Salt has minion event bus authorization bypass vulnerability |
High EPSS 0.17% |
>= 3006.0, < 3006.12 | 3006.12 |
| GHSA-jh7c-xh74-h76f Salt has minion event bus authorization bypass vulnerability |
High EPSS 0.17% |
>= 3006.0, < 3006.12>= 3007.0, < 3007.4 | 3006.123007.4 |
| GHSA-jh7c-xh74-h76f Salt has minion event bus authorization bypass vulnerability |
High EPSS 0.17% |
>= 3007.0, < 3007.4 | 3007.4 |
| GHSA-4j59-vv55-q6h3 Salt's salt.auth.pki module does not properly authenticate callers |
Medium EPSS 0.15% |
>= 3007.0rc1, < 3007.4 | 3007.4 |
| GHSA-4j59-vv55-q6h3 Salt's salt.auth.pki module does not properly authenticate callers |
Medium EPSS 0.15% |
>= 3006.0rc1, < 3006.12>= 3007.0rc1, < 3007.4 | 3006.123007.4 |
| GHSA-4j59-vv55-q6h3 Salt's salt.auth.pki module does not properly authenticate callers |
Medium EPSS 0.15% |
>= 3006.0rc1, < 3006.12 | 3006.12 |
| GHSA-4277-m35q-7c9w Salt preflight script could be attacker controlled |
Medium EPSS 0.21% |
>= 3006.0rc1, < 3006.4 | 3006.4 |
| GHSA-4277-m35q-7c9w Salt preflight script could be attacker controlled |
Medium EPSS 0.21% |
< 3005.4>= 3006.0rc1, < 3006.4 | 3005.43006.4 |
| GHSA-4277-m35q-7c9w Salt preflight script could be attacker controlled |
Medium EPSS 0.21% |
< 3005.4 | 3005.4 |
| GHSA-2qw3-2wv6-p64x Path traversal in saltstack |
High EPSS 0.84% |
< 3005.5>= 3006.0, < 3006.6 | 3005.53006.6 |
| GHSA-2qw3-2wv6-p64x Path traversal in saltstack |
High EPSS 0.84% |
>= 3006.0, < 3006.6 | 3006.6 |
| GHSA-2qw3-2wv6-p64x Path traversal in saltstack |
High EPSS 0.84% |
< 3005.5 | 3005.5 |
| GHSA-q27c-j6j9-53w3 Directory creation by malicious user in saltstack |
Medium EPSS 0.69% |
< 3005.5 | 3005.5 |
| GHSA-q27c-j6j9-53w3 Directory creation by malicious user in saltstack |
Medium EPSS 0.69% |
< 3005.5>= 3006.0, < 3006.6 | 3005.53006.6 |
| GHSA-q27c-j6j9-53w3 Directory creation by malicious user in saltstack |
Medium EPSS 0.69% |
>= 3006.0, < 3006.6 | 3006.6 |
| GHSA-vpjg-wmf8-29h9 Salt vulnerable to denial of service |
Medium EPSS 1.24% |
< 3005.2 | 3005.2 |
| GHSA-qvh6-3j7x-3hq7 Salt can cause Git Providers to get wrong data |
High EPSS 0.32% |
>= 3006.0rc1, < 3006.2 | 3006.2 |
| GHSA-qvh6-3j7x-3hq7 Salt can cause Git Providers to get wrong data |
High EPSS 0.32% |
< 3005.2 | 3005.2 |
| GHSA-vpjg-wmf8-29h9 Salt vulnerable to denial of service |
Medium EPSS 1.24% |
>= 3006.0, < 3006.2< 3005.2 | 3005.23006.2 |
| GHSA-vpjg-wmf8-29h9 Salt vulnerable to denial of service |
Medium EPSS 1.24% |
>= 3006.0rc1, < 3006.2 | 3006.2 |
| GHSA-qvh6-3j7x-3hq7 Salt can cause Git Providers to get wrong data |
High EPSS 0.32% |
>= 3006.0, < 3006.2< 3005.2 | 3005.23006.2 |
| PYSEC-2023-47 Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py… |
Not rated yet EPSS 1.64% |
< 3003.1 | 3003.1 |
| GHSA-fpxm-fprw-6hxj Salt's PAM auth fails to reject locked accounts |
High EPSS 2.06% |
>= 3004.0, < 3004.2 | 3004.2 |
| GHSA-fpxm-fprw-6hxj Salt's PAM auth fails to reject locked accounts |
High EPSS 2.06% |
>= 3003.0, < 3003.5 | 3003.5 |
| GHSA-fpxm-fprw-6hxj Salt's PAM auth fails to reject locked accounts |
High EPSS 2.06% |
< 3002.9 | 3002.9 |
| GHSA-fpxm-fprw-6hxj Salt's PAM auth fails to reject locked accounts |
High EPSS 2.06% |
< 3002.9 | 3002.9 |
| GHSA-gq26-cpq6-w85r SaltStack RSA Key Generation allows remote users to decrypt communications |
High EPSS 1.96% |
< 0.15.1 | 0.15.1 |
| GHSA-gq26-cpq6-w85r SaltStack RSA Key Generation allows remote users to decrypt communications |
High EPSS 1.96% |
< 0.15.1 | 0.15.1 |
| GHSA-2q4g-wfm6-5fpm SaltStack Improper Verification of Cryptographic Signature |
High EPSS 0.88% |
>= 3004, < 3004.1 | 3004.1 |
| GHSA-qcr3-hr2f-6557 SaltStack Salt Permissions Bypass |
High EPSS 1.34% |
< 3002.8 | 3002.8 |
| GHSA-qcr3-hr2f-6557 SaltStack Salt Permissions Bypass |
High EPSS 1.34% |
>= 3004, < 3004.1 | 3004.1 |
| GHSA-qcr3-hr2f-6557 SaltStack Salt Permissions Bypass |
High EPSS 1.34% |
>= 3003, < 3003.4 | 3003.4 |
| GHSA-qcr3-hr2f-6557 SaltStack Salt Permissions Bypass |
High EPSS 1.34% |
< 3002.8 | 3002.8 |
| GHSA-cvcc-5x92-gmhc SaltStack Salt Improper Authentication via Man in the Middle Attack |
Low EPSS 1.62% |
< 3002.8 | 3002.8 |
| GHSA-5r3f-3m3j-wcj2 SaltStack Salt Authentication Bypass by Capture-replay |
High EPSS 0.83% |
< 3002.8 | 3002.8 |
| GHSA-5r3f-3m3j-wcj2 SaltStack Salt Authentication Bypass by Capture-replay |
High EPSS 0.83% |
>= 3004, < 3004.1 | 3004.1 |
| GHSA-5r3f-3m3j-wcj2 SaltStack Salt Authentication Bypass by Capture-replay |
High EPSS 0.83% |
>= 3003, < 3003.4 | 3003.4 |
| GHSA-5r3f-3m3j-wcj2 SaltStack Salt Authentication Bypass by Capture-replay |
High EPSS 0.83% |
< 3002.8 | 3002.8 |
| GHSA-2q4g-wfm6-5fpm SaltStack Improper Verification of Cryptographic Signature |
High EPSS 0.88% |
< 3002.8 | 3002.8 |
| GHSA-2q4g-wfm6-5fpm SaltStack Improper Verification of Cryptographic Signature |
High EPSS 0.88% |
< 3002.8 | 3002.8 |
| GHSA-2q4g-wfm6-5fpm SaltStack Improper Verification of Cryptographic Signature |
High EPSS 0.88% |
>= 3003, < 3003.4 | 3003.4 |
| GHSA-cvcc-5x92-gmhc SaltStack Salt Improper Authentication via Man in the Middle Attack |
Low EPSS 1.62% |
< 3002.8 | 3002.8 |
| GHSA-cvcc-5x92-gmhc SaltStack Salt Improper Authentication via Man in the Middle Attack |
Low EPSS 1.62% |
>= 3004, < 3004.1 | 3004.1 |
| GHSA-cvcc-5x92-gmhc SaltStack Salt Improper Authentication via Man in the Middle Attack |
Low EPSS 1.62% |
>= 3003, < 3003.4 | 3003.4 |
| GHSA-xf37-qcvf-7m57 Improper Authentication in SaltStack Salt |
Medium EPSS 0.35% |
< 3003.3 | 3003.3 |
| GHSA-xf37-qcvf-7m57 Improper Authentication in SaltStack Salt |
Medium EPSS 0.35% |
< 3003.3 | 3003.3 |
| GHSA-pf7h-h2wq-m7pg Exposure of Resource to Wrong Sphere in salt |
High EPSS 3.51% |
< 3003.3 | 3003.3 |
| GHSA-pf7h-h2wq-m7pg Exposure of Resource to Wrong Sphere in salt |
High EPSS 3.51% |
< 3003.3 | 3003.3 |
| GHSA-hcjf-rp5h-g5h3 Command Injection in SaltStack Salt |
High EPSS 5.92% |
>= 2016.11.0, < 3003rc1 | 3003rc1 |
| GHSA-hcjf-rp5h-g5h3 Command Injection in SaltStack Salt |
High EPSS 5.92% |
>= 2016.11.0, < 3003rc1 | 3003rc1 |
| GHSA-pmj6-9f8c-8g2m Saltstack Salt Unauthenticated Arbitrary Code Execution |
High EPSS 2.29% |
< 3002.2 | 3002.2 |
| GHSA-pmj6-9f8c-8g2m Saltstack Salt Unauthenticated Arbitrary Code Execution |
High EPSS 2.29% |
< 3002.2 | 3002.2 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
< 2015.8.13 | 2015.8.13 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-76x4-x3p6-rpr9 SaltStack Salt Directory Traversal vulnerability |
Critical EPSS 92.41% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
< 2015.8.13 | 2015.8.13 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-8rp6-x3r7-5qw3 SaltStack Salt is vulnerable to shell injection via ProxyCommand argument |
Critical EPSS 71.68% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
< 2015.8.13 | 2015.8.13 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-ghc2-hx3w-jqmp SaltStack Salt command injection in the Salt-API when using the Salt-SSH client |
Critical EPSS 8.25% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
< 2015.8.13 | 2015.8.13 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name |
High EPSS 4.30% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
< 2015.8.13 | 2015.8.13 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-qx72-q6w3-qgc7 SaltStack Salt Improper SSL Certificate Validation |
High EPSS 2.96% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
< 2015.8.13 | 2015.8.13 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-r55w-xph5-xvx2 SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod |
Medium EPSS 0.54% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
< 2015.8.13 | 2015.8.13 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration |
Critical EPSS 5.10% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
< 2015.8.13 | 2015.8.13 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-w589-r335-4f55 SaltStack Salt Improper Certificate Validation |
Medium EPSS 3.08% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
< 2015.8.13 | 2015.8.13 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
>= 3002, < 3002.5 | 3002.5 |
| GHSA-xgmh-gfxw-2hvv SaltStack Salt Server Side Template Injection |
Critical EPSS 10.23% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
< 2015.8.13 | 2015.8.13 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 2018.2.0, <= 2018.3.5 | No fix yet |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 3000, < 3000.7 | 3000.7 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 3001, < 3001.5 | 3001.5 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
>= 3002, < 3002.3 | 3002.3 |
| GHSA-xxw3-765m-f37p SaltStack Salt Improper Authentication vulnerability |
Critical EPSS 73.13% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.8>= 2018.3.0rc1, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| PYSEC-2021-362 An issue was discovered in SaltStack Salt before 3002.5. Withdrawn |
Not rated yet | < 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.3.9, < 2016.11.3>= 2016.11.4, < 2016.11.5>= 2016.11.7, < 2016.11.10>= 2017.5.0, < 2017.7.8>= 2018.2.0, < 2019.2.0rc1>= 2019.2.0, < 2019.2.5>= 2019.2.6, < 2019.2.8>= 3000, < 3000.6>= 3001, < 3001.4>= 3002, < 3002.5 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
< 2015.8.13 | 2015.8.13 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 2016.3.0, < 2016.3.8 | 2016.3.8 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 2016.11.0, < 2016.11.10 | 2016.11.10 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 2018.2.0, < 2018.3.5 | 2018.3.5 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 2019.2.0, < 2019.2.6 | 2019.2.6 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.6>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.4>= 2017.7.5, < 2017.7.8>= 2018.3.0rc1, < 2018.3.5>= 2019.2.0, < 2019.2.5>= 3000, < 3000.3 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.62016.11.102017.7.42017.7.82018.3.52019.2.53000.3 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
< 2015.8.13 | 2015.8.13 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 3002, < 3002.1 | 3002.1 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2016.3.0, < 2016.3.8 | 2016.3.8 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2016.11.0, < 2016.11.10 | 2016.11.10 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2018.2.0, < 2018.3.5 | 2018.3.5 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 3001, < 3001.2 | 3001.2 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2019.2.0, < 2019.2.6 | 2019.2.6 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 3000.0, < 3000.4 | 3000.4 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2019.2.0, < 2019.2.6 | 2019.2.6 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.6>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.4>= 2017.7.5, < 2017.7.8>= 2018.3.0rc1, < 2018.3.5>= 2019.2.0, < 2019.2.5>= 3000, < 3000.3 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.62016.11.102017.7.42017.7.82018.3.52019.2.53000.3 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 3000.0, < 3000.4 | 3000.4 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 3001, < 3001.2 | 3001.2 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 3002, < 3002.1 | 3002.1 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
< 2015.8.13 | 2015.8.13 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2016.3.0, < 2016.3.8 | 2016.3.8 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2016.11.0, < 2016.11.10 | 2016.11.10 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client Known exploited |
Critical EPSS 99.59% |
>= 2018.2.0, < 2018.3.5 | 2018.3.5 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 3002, < 3002.1 | 3002.1 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 3001, < 3001.2 | 3001.2 |
| GHSA-3c56-vx6v-q5vh SaltStack Salt Allows creating certificates with weak file permissions |
Medium EPSS 0.42% |
>= 3000, < 3000.4 | 3000.4 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
< 2015.8.13 | 2015.8.13 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 2016.3.0, < 2016.3.8 | 2016.3.8 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 2016.11.0, < 2016.11.10 | 2016.11.10 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 2018.2.0, < 2018.3.5 | 2018.3.5 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 2019.2.0, < 2019.2.7 | 2019.2.7 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 3000.0, < 3000.5 | 3000.5 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 3001.0, < 3001.3 | 3001.3 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
>= 3002.0, < 3002.1 | 3002.1 |
| GHSA-29j3-2446-5j4w SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi |
Critical EPSS 56.82% |
< 2015.8.10>= 2015.8.11, < 2015.8.13>= 2016.3.0, < 2016.3.4>= 2016.3.5, < 2016.3.6>= 2016.3.7, < 2016.3.8>= 2016.11.0, < 2016.11.3>= 2016.11.4, < 2016.11.6>= 2016.11.7, < 2016.11.10>= 2017.7.0, < 2017.7.4>= 2017.7.5, < 2017.7.8>= 2018.3.0rc1, < 2018.3.5>= 2019.2.0, < 2019.2.5>= 3000, < 3000.3 | 2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.62016.11.102017.7.42017.7.82018.3.52019.2.53000.3 |
| CVE-2020-11651 SaltStack Salt Unauthenticated Remote Code Execution Known exploited |
Critical EPSS 96.61% |
>= 3000, < 3000.2 | 3000.2 |
| CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access Known exploited |
High EPSS 86.18% |
< 2019.2.4 | 2019.2.4 |
| CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access Known exploited |
High EPSS 86.18% |
< 2019.2.4>= 3000, < 3000.2 | 2019.2.43000.2 |
| CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access Known exploited |
High EPSS 86.18% |
>= 3000, < 3000.2 | 3000.2 |
| CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access Known exploited |
High EPSS 86.18% |
< 2019.2.4 | 2019.2.4 |
| CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access Known exploited |
High EPSS 86.18% |
>= 3000, < 3000.2 | 3000.2 |
| CVE-2020-11651 SaltStack Salt Unauthenticated Remote Code Execution Known exploited |
Critical EPSS 96.61% |
< 2019.2.4 | 2019.2.4 |
| CVE-2020-11651 SaltStack Salt Unauthenticated Remote Code Execution Known exploited |
Critical EPSS 96.61% |
< 2019.2.4>= 3000, < 3000.2 | 2019.2.43000.2 |
| PYSEC-2020-196 In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. Withdrawn |
Not rated yet | < 2019.2.1 | 2019.2.1 |
| GHSA-q53j-p6r2-g2v4 SaltStack Salt is vulnerable to command injection |
Critical EPSS 15.16% |
< 2019.2.3 | 2019.2.3 |
| GHSA-q53j-p6r2-g2v4 SaltStack Salt is vulnerable to command injection |
Critical EPSS 15.16% |
< 2019.2.1 | 2019.2.1 |
| PYSEC-2019-49 SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. Withdrawn |
Not rated yet | < 2018.3.4 | 2018.3.4 |
| GHSA-h8xp-h3jf-wv4v SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function |
Critical EPSS 1.90% |
< 2018.3.4 | 2018.3.4 |
| GHSA-h8xp-h3jf-wv4v SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function |
Critical EPSS 1.90% |
>= 2018.3.0, < 2018.3.4 | 2018.3.4 |
| GHSA-jx34-pppm-gjvr SaltStack Salt Directory Traversal vulnerability in salt-api |
Medium EPSS 4.28% |
>= 2017.7.0, < 2017.7.8 | 2017.7.8 |
| GHSA-x549-r7m8-gv63 SaltStack Salt Remote command execution and incorrect access control when using salt-api |
Critical EPSS 4.90% |
>= 2018.3.0, < 2018.3.3< 2017.7.8 | 2017.7.82018.3.3 |
| GHSA-x549-r7m8-gv63 SaltStack Salt Remote command execution and incorrect access control when using salt-api |
Critical EPSS 4.90% |
>= 2018.3.0, < 2018.3.3 | 2018.3.3 |
| GHSA-x549-r7m8-gv63 SaltStack Salt Remote command execution and incorrect access control when using salt-api |
Critical EPSS 4.90% |
>= 2017.7.0, < 2017.7.8 | 2017.7.8 |
| GHSA-jx34-pppm-gjvr SaltStack Salt Directory Traversal vulnerability in salt-api |
Medium EPSS 4.28% |
< 2017.7.8>= 2018.3.0, < 2018.3.3 | 2017.7.82018.3.3 |
| GHSA-jx34-pppm-gjvr SaltStack Salt Directory Traversal vulnerability in salt-api |
Medium EPSS 4.28% |
>= 2016.11.0, < 2016.11.10 | 2016.11.10 |
| GHSA-jx34-pppm-gjvr SaltStack Salt Directory Traversal vulnerability in salt-api |
Medium EPSS 4.28% |
>= 2018.3.0, < 2018.3.3 | 2018.3.3 |
| GHSA-x549-r7m8-gv63 SaltStack Salt Remote command execution and incorrect access control when using salt-api |
Critical EPSS 4.90% |
>= 2016.11.0, < 2016.11.10 | 2016.11.10 |
| GHSA-g283-88v5-rmq2 SaltStack Salt allows compromised salt-minions to impersonate the salt-master |
Critical EPSS 1.39% |
< 2016.3.6 | 2016.3.6 |
| GHSA-g283-88v5-rmq2 SaltStack Salt allows compromised salt-minions to impersonate the salt-master |
Critical EPSS 1.39% |
< 2016.3.6 | 2016.3.6 |
| GHSA-j6gj-pg62-x8j6 SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 3.19% |
>= 2017.7.0, < 2017.7.2 | 2017.7.2 |
| GHSA-j6gj-pg62-x8j6 SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 3.19% |
< 2016.3.8 | 2016.3.8 |
| GHSA-j6gj-pg62-x8j6 SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 3.19% |
< 2016.3.8>= 2016.11, < 2016.11.8>= 2017.7, < 2017.7.2 | 2016.3.82016.11.82017.7.2 |
| GHSA-j6gj-pg62-x8j6 SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 3.19% |
>= 2016.11.0, < 2016.11.8 | 2016.11.8 |
| GHSA-657p-cj5r-mjrh SaltStack Salt Denial of Service via a crafted authentication request |
High EPSS 3.70% |
< 2016.3.8>= 2016.11, < 2016.11.8>= 2017.7, < 2017.7.2 | 2016.3.82016.11.82017.7.2 |
| GHSA-657p-cj5r-mjrh SaltStack Salt Denial of Service via a crafted authentication request |
High EPSS 3.70% |
>= 2017.7.0, < 2017.7.2 | 2017.7.2 |
| GHSA-657p-cj5r-mjrh SaltStack Salt Denial of Service via a crafted authentication request |
High EPSS 3.70% |
>= 2016.11.0, < 2016.11.8 | 2016.11.8 |
| GHSA-657p-cj5r-mjrh SaltStack Salt Denial of Service via a crafted authentication request |
High EPSS 3.70% |
< 2016.3.8 | 2016.3.8 |
| GHSA-q2x6-8gfj-hjxw salt leaks git usernames and passwords to the log |
Medium EPSS 1.25% |
< 2015.5.5 | 2015.5.5 |
| GHSA-q2x6-8gfj-hjxw salt leaks git usernames and passwords to the log |
Medium EPSS 1.25% |
< 2015.5.5 | 2015.5.5 |
| GHSA-f2h7-4f84-8qrm SaltStack Salt Authentication Bypass when using the local_batch client from salt-api |
High EPSS 1.70% |
< 2015.8.13>= 2016.3, < 2016.3.5>= 2016.11, < 2016.11.2 | 2015.8.132016.3.52016.11.2 |
| GHSA-f2h7-4f84-8qrm SaltStack Salt Authentication Bypass when using the local_batch client from salt-api |
High EPSS 1.70% |
< 2015.8.13 | 2015.8.13 |
| GHSA-8r7r-x48r-pf8f SaltStack Salt arbitrary command execution in Salt-api via ssh_client |
High EPSS 3.23% |
< 2015.8.13>= 2016.3, < 2016.3.5>= 2016.11, < 2016.11.2 | 2015.8.132016.3.52016.11.2 |
| GHSA-8r7r-x48r-pf8f SaltStack Salt arbitrary command execution in Salt-api via ssh_client |
High EPSS 3.23% |
>= 2016.11.0, < 2016.11.2 | 2016.11.2 |
| GHSA-8r7r-x48r-pf8f SaltStack Salt arbitrary command execution in Salt-api via ssh_client |
High EPSS 3.23% |
>= 2016.3.0, < 2016.3.5 | 2016.3.5 |
| GHSA-8r7r-x48r-pf8f SaltStack Salt arbitrary command execution in Salt-api via ssh_client |
High EPSS 3.23% |
< 2015.8.13 | 2015.8.13 |
| GHSA-f2h7-4f84-8qrm SaltStack Salt Authentication Bypass when using the local_batch client from salt-api |
High EPSS 1.70% |
>= 2016.11.0, < 2016.11.2 | 2016.11.2 |
| GHSA-f2h7-4f84-8qrm SaltStack Salt Authentication Bypass when using the local_batch client from salt-api |
High EPSS 1.70% |
>= 2016.3.0, < 2016.3.5 | 2016.3.5 |
| GHSA-8j9g-c9rp-jvg4 Salt vulnerable to Improper Certificate Validation |
High EPSS 1.06% |
< 2014.7.6 | 2014.7.6 |
| GHSA-8j9g-c9rp-jvg4 Salt vulnerable to Improper Certificate Validation |
High EPSS 1.06% |
< 2014.7.6 | 2014.7.6 |
| GHSA-xxvj-8g5m-4qgw SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 4.67% |
< 2016.11.7>= 2017.7, < 2017.7.1 | 2016.11.72017.7.1 |
| GHSA-xxvj-8g5m-4qgw SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 4.67% |
< 2016.11.7 | 2016.11.7 |
| GHSA-xxvj-8g5m-4qgw SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 4.67% |
>= 2017.7.0, < 2017.7.1 | 2017.7.1 |
| GHSA-xxvj-8g5m-4qgw SaltStack Salt Directory traversal vulnerability in minion id validation |
Critical EPSS 4.67% |
No fix yet | |
| GHSA-cxm4-7qcw-267r salt password information leaked in debug logs |
Critical EPSS 2.83% |
>= 2015.8, < 2015.8.1 | 2015.8.1 |
| GHSA-cxm4-7qcw-267r salt password information leaked in debug logs |
Critical EPSS 2.83% |
>= 2015.5, < 2015.5.6 | 2015.5.6 |
| GHSA-cxm4-7qcw-267r salt password information leaked in debug logs |
Critical EPSS 2.83% |
>= 2015.5, < 2015.5.6>= 2015.8, < 2015.8.1 | 2015.5.62015.8.1 |
| GHSA-xcx4-5wq7-g5g7 SaltStack Salt Information Exposure |
High EPSS 0.43% |
>= 2016.11, < 2016.11.4 | 2016.11.4 |
| GHSA-xcx4-5wq7-g5g7 SaltStack Salt Information Exposure |
High EPSS 0.43% |
>= 2016.11, < 2016.11.4 | 2016.11.4 |
| GHSA-92pw-mff9-jqgm Salt improper handling of tmp files |
Medium EPSS 0.43% |
< 2014.7.4 | 2014.7.4 |
| GHSA-6grp-75pq-c8cj SaltStack has insecure /tmp file handling in salt/modules/chef.py |
Medium EPSS 0.43% |
< 2014.7.4 | 2014.7.4 |
| GHSA-6grp-75pq-c8cj SaltStack has insecure /tmp file handling in salt/modules/chef.py |
Medium EPSS 0.43% |
< 2014.7.4 | 2014.7.4 |
| GHSA-92pw-mff9-jqgm Salt improper handling of tmp files |
Medium EPSS 0.43% |
< 2014.7.4 | 2014.7.4 |
| GHSA-hvmj-356c-gpf4 Salt allows deleted minions to read or write to minions with the same id |
Critical EPSS 2.60% |
< 2015.8.11 | 2015.8.11 |
| GHSA-hvmj-356c-gpf4 Salt allows deleted minions to read or write to minions with the same id |
Critical EPSS 2.60% |
< 2015.8.11 | 2015.8.11 |
| GHSA-v2rp-9cpj-pfw2 Salt Insecure configuration of PAM external authentication service |
Medium EPSS 0.87% |
< 2015.5.10>= 2015.8, < 2015.8.8 | 2015.5.102015.8.8 |
| GHSA-v2rp-9cpj-pfw2 Salt Insecure configuration of PAM external authentication service |
Medium EPSS 0.87% |
< 2015.5.10 | 2015.5.10 |
| GHSA-v2rp-9cpj-pfw2 Salt Insecure configuration of PAM external authentication service |
Medium EPSS 0.87% |
>= 2015.8, < 2015.8.8 | 2015.8.8 |
| GHSA-6prw-8xhm-h247 Salt uses weak permissions on the cache data |
Low EPSS 0.41% |
< 2015.8.3 | 2015.8.3 |
| GHSA-6prw-8xhm-h247 Salt uses weak permissions on the cache data |
Low EPSS 0.41% |
< 2015.8.3 | 2015.8.3 |
| GHSA-vqh4-crjf-jjxx Salt Improper Access Control |
High EPSS 1.52% |
>= 2015.8, < 2015.8.4 | 2015.8.4 |
| GHSA-vqh4-crjf-jjxx Salt Improper Access Control |
High EPSS 1.52% |
>= 2015.8.0rc1, < 2015.8.4 | 2015.8.4 |
| GHSA-mfr3-9cj8-h2qm SaltStack Salt Insecure Temporary File Creation |
High EPSS 0.41% |
< 2014.1.10 | 2014.1.10 |
| GHSA-mfr3-9cj8-h2qm SaltStack Salt Insecure Temporary File Creation |
High EPSS 0.41% |
< 2014.1.10 | 2014.1.10 |
| GHSA-v89f-4mc4-h6w9 Salt has insufficient argument validation in several modules |
High EPSS 1.52% |
>= 0.15.0, < 0.17.1 | 0.17.1 |
| GHSA-jmv9-5gx8-7xpf Minion identity not validated in saltstack |
Medium EPSS 1.49% |
< 0.17.1 | 0.17.1 |
| GHSA-7wx3-vr2f-6p29 SaltStack Privilege Escalation vulnerability |
High EPSS 3.05% |
>= 0.11.0, < 0.17.1 | 0.17.1 |
| GHSA-7wx3-vr2f-6p29 SaltStack Privilege Escalation vulnerability |
High EPSS 3.05% |
>= 0.11.0, < 0.17.1 | 0.17.1 |
| GHSA-qr3x-v97p-42xw SaltStack insecurely uses /tmp |
High EPSS 1.46% |
>= 0.17.0, < 0.17.1 | 0.17.1 |
| GHSA-jmv9-5gx8-7xpf Minion identity not validated in saltstack |
Medium EPSS 1.49% |
>= 0.15.0, < 0.17.1 | 0.17.1 |
| GHSA-v89f-4mc4-h6w9 Salt has insufficient argument validation in several modules |
High EPSS 1.52% |
>= 0.15.0, < 0.17.1 | 0.17.1 |
| GHSA-qr3x-v97p-42xw SaltStack insecurely uses /tmp |
High EPSS 1.46% |
>= 0.17.0, < 0.17.1 | 0.17.1 |
| PYSEC-2013-13 Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. |
Not rated yet EPSS 2.12% |
< 0.17.1 | 0.17.1 |
| GHSA-f22j-37jj-cxw9 SaltStack MITM SSH attack in salt-ssh |
High EPSS 1.82% |
>= 0.17.0, < 0.17.1 | 0.17.1 |
| GHSA-f22j-37jj-cxw9 SaltStack MITM SSH attack in salt-ssh |
High EPSS 1.82% |
>= 0.17.0, < 0.17.1 | 0.17.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor