p PatchFirst

CVE-2025-22242

CVE-2025-22242 · CVE-2025-22242 salt advisory

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.

CVSS 5.6 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • salt

    Versions
    • ≥ 3006.x, < 3006.12: Affected (lts)
    • ≥ 3007.x, < 3007.4: Affected (sts)

    Update to 3006.12; Update to 3007.4

  • salt PyPI

    Versions
    • 3007.0
    • 3007.0rc1
    • 3007.1
    • 3007.2
    • 3007.3
    Affected ranges
    • ECOSYSTEM: ≥ 3007.0rc1, < 3007.4

    Update to 3007.4

  • salt PyPI

    Versions
    • 3006.0
    • 3006.0rc1
    • 3006.0rc2
    • 3006.0rc3
    • 3006.1
    • 3006.10
    • 3006.11
    • 3006.2
    • 3006.3
    • 3006.4
    • 3006.5
    • 3006.6
    • 3006.7
    • 3006.8
    • 3006.9
    Affected ranges
    • ECOSYSTEM: ≥ 3006.0rc1, < 3006.12

    Update to 3006.12

  • salt PyPI

    Versions
    • 3006.0
    • 3006.0rc1
    • 3006.0rc2
    • 3006.0rc3
    • 3006.1
    • 3006.10
    • 3006.11
    • 3006.2
    • 3006.3
    • 3006.4
    • 3006.5
    • 3006.6
    • 3006.7
    • 3006.8
    • 3006.9
    • 3007.0
    • 3007.0rc1
    • 3007.1
    • 3007.2
    • 3007.3
    Affected ranges
    • ECOSYSTEM: ≥ 3007.0rc1, < 3007.4 ∪ ≥ 3006.0rc1, < 3006.12

    Update to 3007.4; Update to 3006.12

  • salt Ubuntu:Pro:14.04:LTS

    Versions
    • 0.16.0-1
    • 0.16.4-2
    • 0.17.1+dfsg-1
    • 0.17.2-1
    • 0.17.2-2
    • 0.17.2-3
    • 0.17.4-1
    • 0.17.4-2
    • 0.17.5-1
    • 0.17.5+ds-1
    • 0.17.5+ds-1ubuntu0.1~esm1
    • 0.17.5+ds-1ubuntu0.1~esm2
    • 0.17.5+ds-1ubuntu0.1~esm4
    • 0.17.5+ds-1ubuntu0.1~esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • salt Ubuntu:Pro:16.04:LTS

    Versions
    • 2015.5.3+ds-1
    • 2015.8.1+ds-2
    • 2015.8.3+ds-1
    • 2015.8.3+ds-2
    • 2015.8.3+ds-3
    • 2015.8.5+ds-1
    • 2015.8.7+ds-1
    • 2015.8.8+ds-1
    • 2015.8.8+ds-1ubuntu0.1~esm1
    • 2015.8.8+ds-1ubuntu0.1
    • 2015.8.8+ds-1ubuntu0.1+esm1
    • 2015.8.8+ds-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • salt Ubuntu:Pro:18.04:LTS

    Versions
    • 2016.11.5+ds-1
    • 2016.11.8+dfsg1-1
    • 2017.7.2+dfsg1-2ubuntu1
    • 2017.7.3+dfsg1-1
    • 2017.7.4+dfsg1-1
    • 2017.7.4+dfsg1-1ubuntu18.04.1
    • 2017.7.4+dfsg1-1ubuntu18.04.2
    • 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • salt Ubuntu:22.04:LTS

    Versions
    • 3002.6+dfsg1-4
    • 3002.7+dfsg1-1
    • 3004+dfsg1-4
    • 3004+dfsg1-5
    • 3004+dfsg1-6ubuntu1
    • 3004+dfsg1-7
    • 3004+dfsg1-8
    • 3004.1+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →