p PatchFirst

CVE-2025-22238

CVE-2025-22238 · CVE-2025-22238 salt advisory

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

CVSS 4.2 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • salt

    Versions
    • ≥ 3006.x, < 3006.12: Affected (lts)
    • ≥ 3007.x, < 3007.4: Affected (sts)

    Update to 3006.12; Update to 3007.4

  • salt PyPI

    Versions
    • 3006.0
    • 3006.0rc1
    • 3006.0rc2
    • 3006.0rc3
    • 3006.1
    • 3006.10
    • 3006.11
    • 3006.2
    • 3006.3
    • 3006.4
    • 3006.5
    • 3006.6
    • 3006.7
    • 3006.8
    • 3006.9
    Affected ranges
    • ECOSYSTEM: ≥ 3006.0rc1, < 3006.12

    Update to 3006.12

  • salt PyPI

    Versions
    • 3007.0
    • 3007.0rc1
    • 3007.1
    • 3007.2
    • 3007.3
    Affected ranges
    • ECOSYSTEM: ≥ 3007.0rc1, < 3007.4

    Update to 3007.4

  • salt PyPI

    Versions
    • 3006.0
    • 3006.0rc1
    • 3006.0rc2
    • 3006.0rc3
    • 3006.1
    • 3006.10
    • 3006.11
    • 3006.2
    • 3006.3
    • 3006.4
    • 3006.5
    • 3006.6
    • 3006.7
    • 3006.8
    • 3006.9
    • 3007.0
    • 3007.0rc1
    • 3007.1
    • 3007.2
    • 3007.3
    Affected ranges
    • ECOSYSTEM: ≥ 3006.0rc1, < 3006.12 ∪ ≥ 3007.0rc1, < 3007.4

    Update to 3006.12; Update to 3007.4

  • salt Ubuntu:Pro:14.04:LTS

    Versions
    • 0.16.0-1
    • 0.16.4-2
    • 0.17.1+dfsg-1
    • 0.17.2-1
    • 0.17.2-2
    • 0.17.2-3
    • 0.17.4-1
    • 0.17.4-2
    • 0.17.5-1
    • 0.17.5+ds-1
    • 0.17.5+ds-1ubuntu0.1~esm1
    • 0.17.5+ds-1ubuntu0.1~esm2
    • 0.17.5+ds-1ubuntu0.1~esm4
    • 0.17.5+ds-1ubuntu0.1~esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • salt Ubuntu:Pro:16.04:LTS

    Versions
    • 2015.5.3+ds-1
    • 2015.8.1+ds-2
    • 2015.8.3+ds-1
    • 2015.8.3+ds-2
    • 2015.8.3+ds-3
    • 2015.8.5+ds-1
    • 2015.8.7+ds-1
    • 2015.8.8+ds-1
    • 2015.8.8+ds-1ubuntu0.1~esm1
    • 2015.8.8+ds-1ubuntu0.1
    • 2015.8.8+ds-1ubuntu0.1+esm1
    • 2015.8.8+ds-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • salt Ubuntu:Pro:18.04:LTS

    Versions
    • 2016.11.5+ds-1
    • 2016.11.8+dfsg1-1
    • 2017.7.2+dfsg1-2ubuntu1
    • 2017.7.3+dfsg1-1
    • 2017.7.4+dfsg1-1
    • 2017.7.4+dfsg1-1ubuntu18.04.1
    • 2017.7.4+dfsg1-1ubuntu18.04.2
    • 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • salt Ubuntu:22.04:LTS

    Versions
    • 3002.6+dfsg1-4
    • 3002.7+dfsg1-1
    • 3004+dfsg1-4
    • 3004+dfsg1-5
    • 3004+dfsg1-6ubuntu1
    • 3004+dfsg1-7
    • 3004+dfsg1-8
    • 3004.1+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →