It was discovered that Salt allows remote attackers to determine which files exist on the server. An attacker could use that to extract sensitive information. (CVE-2018-15750)
It was discovered that Salt has a vulnerability that allows an user to bypass authentication. An attacker could use that to extract sensitive information, execute abritrary code or crash the server. (CVE-2018-15751)
It was discovered that Salt is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. (CVE-2019-17361)
It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)
{ "availability": "No subscription required", "binaries": [ { "salt-cloud": "2015.8.8+ds-1ubuntu0.1", "salt-common": "2015.8.8+ds-1ubuntu0.1", "salt-syndic": "2015.8.8+ds-1ubuntu0.1", "salt-ssh": "2015.8.8+ds-1ubuntu0.1", "salt-master": "2015.8.8+ds-1ubuntu0.1", "salt-doc": "2015.8.8+ds-1ubuntu0.1", "salt-api": "2015.8.8+ds-1ubuntu0.1", "salt-minion": "2015.8.8+ds-1ubuntu0.1", "salt-proxy": "2015.8.8+ds-1ubuntu0.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "salt-cloud": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-common": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-syndic": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-ssh": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-master": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-doc": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-api": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-minion": "2017.7.4+dfsg1-1ubuntu18.04.2", "salt-proxy": "2017.7.4+dfsg1-1ubuntu18.04.2" } ] }