Salt Security Bulletin: Multiple Vulnerabilities Fixed (CVE-2024-38822, 38824, 2025-22236, etc.)

Critical Vulnerability Information Fixed Vulnerabilities (FIXED) CVE-2024-38822: Multiple methods in Salt master skip minion token validation, allowing a malicious minion to impersonate another minion. - CVSS Score: 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVE-2024-38823: Salt's request server is vulnerable to replay attacks when not using TLS encryption for transmission. - CVSS Score: 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVE-2024-38824: A directory traversal vulnerability in the recv_file method allows arbitrary files to be written to the master cache directory. - CVSS Score: 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVE-2024-38825: The salt.auth.pk module fails to properly validate the caller. The "password" field contains a CA certificate, which the module validates. This is not PKI authentication, as the caller does not need access to the corresponding private key to be accepted for authentication attempts. - CVSS Score: 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVE-2025-22236: Minion event bus authorization bypass. An attacker with access to minion keys can craft a message that may allow execution of jobs on other minions (>= 3007.0). - CVSS Score: 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L CVE-2025-22237: An attacker with access to minion keys can exploit the "on-demand" pillar feature with a specially crafted git URL, potentially leading to arbitrary command execution on the master with the same privileges as the master process. - CVSS Score: 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2025-22238: Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to directory traversal attacks, which could be exploited to write or overwrite "cache" files outside the cache directory. - CVSS Score: 4.2 AV:L/AC:L/PR:H/UIR:S/U/C:N/I:H/A:N CVE-2025-22239: Arbitrary event injection on Salt Master. The master's ".minion_event" method can be exploited by any authorized minion to send arbitrary events to the master's event bus. - CVSS Score: 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L CVE-2025-22240: Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, "os.path.join" is used to construct paths from unvalidated input. This could be exploited by attackers to delete any file accessible to the Master process. - CVSS Score: 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVE-2025-22241: File content overwrite. The VirtKey class is called when requesting "on-demand pillar" data and uses unvalidated input to construct a path to the "pki directory". This feature is used to automatically accept minion authentication keys based on pre-existing "authorized files" located at specific paths and default configurations. - CVSS Score: 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2025-22242: Denial of service via file read operations. A vulnerability exists in the Master's "pub_ref" method, exposed to all minions. The unvalidated input value "jid" is used to build a path, which is then opened for reading. Attackers can exploit this by attempting to read filenames that return no data, such as targeting pipe nodes in the proc filesystem. - CVSS Score: 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H Additionally, this release includes sqlite 3.50.1 to address CVE-2025-29087 #68033.

Goal Reached Thanks to every supporter — we hit 100%!

Salt Security Bulletin: Multiple Vulnerabilities Fixed (CVE-2024-38822, 38824, 2025-22236, etc.)