SUSE-SU-2025:20487-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2025/suse-su-202520487-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20487-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2025:20487-1
Upstream
CVE (12)
  • CVE-2024-38822
  • CVE-2024-38823
  • CVE-2024-38824
  • CVE-2024-38825
  • CVE-2025-22236
  • CVE-2025-22237
  • CVE-2025-22238
  • CVE-2025-22239
  • CVE-2025-22240
  • CVE-2025-22241
  • CVE-2025-22242
  • CVE-2025-47287
Related
CVE (12)
  • CVE-2024-38822
  • CVE-2024-38823
  • CVE-2024-38824
  • CVE-2024-38825
  • CVE-2025-22236
  • CVE-2025-22237
  • CVE-2025-22238
  • CVE-2025-22239
  • CVE-2025-22240
  • CVE-2025-22241
  • CVE-2025-22242
  • CVE-2025-47287
Published
2025-07-23T13:41:40Z
Modified
2026-03-11T07:29:46Z
Summary
Security update for salt
Details

This update for salt fixes the following issues:

  • Security issues fixed:

    • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
    • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
    • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
    • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
    • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
    • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
    • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
    • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
    • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
    • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
    • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
    • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

  • Other bugs fixed:

    • Added subsystem filter to udev.exportdb (bsc#1236621)
    • Fixed Ubuntu 24.04 edge-case test failures
    • Fixed refresh of osrelease and related grains on Python 3.10+
    • Fixed issue requiring proper Python flavor for dependencies
References

Affected packages

SUSE:Linux Micro 6.1 / salt

Package

Name
salt
Purl
pkg:rpm/suse/salt&distro=SUSE%20Linux%20Micro%206.1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3006.0-slfo.1.1_4.1

Ecosystem specific 

{
    "binaries":  [
        {
            "python311-salt":  "3006.0-slfo.1.1_4.1",
            "salt":  "3006.0-slfo.1.1_4.1",
            "salt-minion":  "3006.0-slfo.1.1_4.1",
            "salt-transactional-update":  "3006.0-slfo.1.1_4.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20487-1.json"