Skip to content

Commit b08be7b

Browse files
dwozdwoz
committed
Merge branch '3006.x' into 3007.x
2 parents 37ebdac + 1245edf commit b08be7b

File tree

6 files changed

+283
-56
lines changed

6 files changed

+283
-56
lines changed

‎CHANGELOG.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,69 @@ Versions are `MAJOR.PATCH`.
1616

1717

1818
## 3007.2 (2025-05-13)
19+
## 3006.12 (2025-06-12)
20+
21+
22+
### Fixed
23+
24+
- CVE-2024-38822
25+
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
26+
27+
CVSS 2.7 V:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
28+
29+
CVE-2024-38823
30+
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
31+
32+
CVSS Score 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
33+
34+
CVE-2024-38824
35+
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
36+
37+
CVSS Score 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
38+
39+
CVE-2024-38825
40+
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
41+
42+
CVSS Score 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
43+
44+
CVE-2025-22236
45+
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
46+
47+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
48+
49+
CVE-2025-22237
50+
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
51+
52+
CVSS 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
53+
54+
CVE-2025-22238
55+
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
56+
57+
CVSS 4.2 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
58+
59+
CVE-2025-22239
60+
Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
61+
62+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
63+
64+
CVE-2025-22240
65+
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to
66+
67+
CVSS 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
68+
69+
CVE-2025-22241
70+
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
71+
72+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
73+
74+
CVE-2025-22242
75+
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
76+
77+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H
78+
79+
This release also includes sqlite 3.50.1 to address CVE-2025-29087 [#68033](https://github.com/saltstack/salt/issues/68033)
80+
81+
1982
## 3006.11 (2025-06-02)
2083

2184

‎changelog/68033.fixed.md‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

‎doc/topics/releases/3006.12.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
(release-3006.12)=
2+
# Salt 3006.12 release notes
3+
4+
<!---
5+
Do not edit this file. This is auto generated.
6+
Edit the templates in doc/topics/releases/templates/
7+
for a given release.
8+
-->
9+
10+
11+
<!--
12+
Add release specific details below
13+
-->
14+
15+
<!--
16+
Do not edit the changelog below.
17+
This is auto generated.
18+
-->
19+
## Changelog
20+
21+
### Fixed
22+
23+
- CVE-2024-38822
24+
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
25+
26+
CVSS 2.7 V:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
27+
28+
CVE-2024-38823
29+
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
30+
31+
CVSS Score 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
32+
33+
CVE-2024-38824
34+
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
35+
36+
CVSS Score 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
37+
38+
CVE-2024-38825
39+
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
40+
41+
CVSS Score 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
42+
43+
CVE-2025-22236
44+
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
45+
46+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
47+
48+
CVE-2025-22237
49+
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
50+
51+
CVSS 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
52+
53+
CVE-2025-22238
54+
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
55+
56+
CVSS 4.2 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
57+
58+
CVE-2025-22239
59+
Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
60+
61+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
62+
63+
CVE-2025-22240
64+
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to
65+
66+
CVSS 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
67+
68+
CVE-2025-22241
69+
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
70+
71+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
72+
73+
CVE-2025-22242
74+
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
75+
76+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H
77+
78+
This release also includes sqlite 3.50.1 to address CVE-2025-29087 [#68033](https://github.com/saltstack/salt/issues/68033)

‎doc/topics/releases/templates/3006.12.md.template‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
(release-3006.12)=
2+
# Salt 3006.12 release notes{{ unreleased }}
3+
{{ warning }}
4+
5+
<!--
6+
Add release specific details below
7+
-->
8+
9+
<!--
10+
Do not edit the changelog below.
11+
This is auto generated.
12+
-->
13+
## Changelog
14+
{{ changelog }}

‎pkg/debian/changelog‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,69 @@
1+
salt (3006.12) stable; urgency=medium
2+
3+
4+
# Fixed
5+
6+
* CVE-2024-38822
7+
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
8+
9+
CVSS 2.7 V:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
10+
11+
CVE*2024-38823
12+
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
13+
14+
CVSS Score 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
15+
16+
CVE*2024-38824
17+
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
18+
19+
CVSS Score 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
20+
21+
CVE*2024-38825
22+
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
23+
24+
CVSS Score 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
25+
26+
CVE*2025-22236
27+
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
28+
29+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
30+
31+
CVE*2025-22237
32+
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
33+
34+
CVSS 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
35+
36+
CVE*2025-22238
37+
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
38+
39+
CVSS 4.2 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
40+
41+
CVE*2025-22239
42+
Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
43+
44+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
45+
46+
CVE*2025-22240
47+
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to
48+
49+
CVSS 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
50+
51+
CVE*2025-22241
52+
File contents overwrite the VirtKey class is called when “on*demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
53+
54+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
55+
56+
CVE*2025-22242
57+
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un*sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
58+
59+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H
60+
61+
This release also includes sqlite 3.50.1 to address CVE*2025-29087 [#68033](https://github.com/saltstack/salt/issues/68033)
62+
63+
64+
-- Salt Project Packaging <[email protected]> Thu, 12 Jun 2025 16:46:43 +0000
65+
66+
167
salt (3007.3) stable; urgency=medium
268

369

‎pkg/rpm/salt.spec‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -734,6 +734,68 @@ if [ $1 -ge 1 ] ; then
734734
fi
735735

736736
%changelog
737+
* Thu Jun 12 2025 Salt Project Packaging <[email protected]> - 3006.12
738+
739+
# Fixed
740+
741+
- CVE-2024-38822
742+
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
743+
744+
CVSS 2.7 V:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
745+
746+
CVE-2024-38823
747+
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
748+
749+
CVSS Score 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
750+
751+
CVE-2024-38824
752+
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
753+
754+
CVSS Score 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
755+
756+
CVE-2024-38825
757+
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
758+
759+
CVSS Score 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
760+
761+
CVE-2025-22236
762+
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
763+
764+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
765+
766+
CVE-2025-22237
767+
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
768+
769+
CVSS 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
770+
771+
CVE-2025-22238
772+
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
773+
774+
CVSS 4.2 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
775+
776+
CVE-2025-22239
777+
Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
778+
779+
CVSS 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
780+
781+
CVE-2025-22240
782+
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to
783+
784+
CVSS 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
785+
786+
CVE-2025-22241
787+
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
788+
789+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
790+
791+
CVE-2025-22242
792+
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
793+
794+
CVSS 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H
795+
796+
This release also includes sqlite 3.50.1 to address CVE-2025-29087 [#68033](https://github.com/saltstack/salt/issues/68033)
797+
798+
737799
* Wed Jun 04 2025 Salt Project Packaging <[email protected]> - 3007.3
738800

739801
# Added

0 commit comments

Comments
 (0)