CVE-2025-22237
Fixed in a distro release EPSS <1%CVSS 6.7
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
Products: VMware SALT
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | salt | 3006.12 |
| PyPI | salt | 3007.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy | 3.11.11-1.32.1 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-core | 3.11.11-1.32.1 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-cython | 0.29.37-1.12.2 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-jinja2 | 3.1.2-1.12.2 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-lxml | 4.9.4-1.21.1 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-m2crypto | 0.45.1-1.12.1 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-msgpack | 1.0.7-1.14.1 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-ply | 3.11-1.8.1 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-tornado | 6.3.2-1.12.2 |
| SUSE EL-9 Update Products SaltBundle Update | saltbundlepy-zypp-plugin | 0.6.5-1.11.1 |
| SUSE EL-9 Update Products SaltBundle Update | venv-salt-minion | 3006.0-1.59.1 |
| SUSE Enterprise Storage 7.1 | salt | 3006.0-150300.53.94.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | salt | 3006.0-150300.53.94.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | salt | 3006.0-150400.8.80.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | salt | 3006.0-150400.8.80.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise Micro 5.1 | salt | 3006.0-150300.53.94.1 |
| SUSE Linux Enterprise Micro 5.2 | salt | 3006.0-150300.53.94.1 |
| SUSE Linux Enterprise Micro 5.3 | salt | 3006.0-150400.8.80.1 |
| SUSE Linux Enterprise Micro 5.4 | salt | 3006.0-150400.8.80.1 |
| SUSE Linux Enterprise Micro 5.5 | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise Module for Systems Management 15 SP7 | salt | 3006.0-150700.14.5.2 |
| SUSE Linux Enterprise Module for Transactional Server 15 SP6 | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | salt | 3006.0-150300.53.94.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | salt | 3006.0-150400.8.80.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | salt | 3006.0-150300.53.94.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | salt | 3006.0-150400.8.80.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | salt | 3006.0-150500.4.55.1 |
| SUSE Linux Micro 6.0 | salt | 3006.0-13.1 |
| SUSE Linux Micro 6.1 | salt | 3006.0-slfo.1.1_4.1 |
| SUSE Manager Client Tools 12 | venv-salt-minion | 3006.0-3.76.2 |
| SUSE Manager Client Tools 15 | venv-salt-minion | 3006.0-150000.3.78.1 |
| SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | venv-salt-minion | 3006.0-1.59.1 |
| SUSE Manager Client Tools for SLE Micro 5 | venv-salt-minion | 3006.0-150000.3.78.1 |
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.16-150400.3.98.1 |
| SUSE Manager Proxy 4.3 | salt | 3006.0-150400.8.80.1 |
| SUSE Manager Proxy Module 4.3 | venv-salt-minion | 3006.0-150000.3.78.1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.16-150400.3.140.1 |
| SUSE Manager Server 4.3 | salt | 3006.0-150400.8.80.1 |
| SUSE Manager Server Module 4.3 | venv-salt-minion | 3006.0-150000.3.78.1 |
| Ubuntu 22.04 LTS | salt | no fix |
| Ubuntu Pro 14.04 LTS | salt | no fix |
| Ubuntu Pro 16.04 LTS | salt | no fix |
| Ubuntu Pro 18.04 LTS | salt | no fix |
| openSUSE Leap 15.6 | salt | 3006.0-150500.4.55.1 |
| openSUSE Leap 15.6 | salt-test | 3006.0-150500.4.55.1 |
| openSUSE Tumbleweed | salt | 3006.0-41.1 |