Salt Security Bulletin: Multiple Vulnerabilities (CVE-2024-38822 to CVE-2025-22242) including RCE and Directory Traversal

Critical Vulnerability Information Fixed Vulnerabilities 1. CVE-2024-38822 - Description: Multiple methods in Salt master bypassed minion token validation, allowing a malicious minion to impersonate another minion. - CVSS Score: 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N 2. CVE-2024-38823 - Description: Salt's request server is vulnerable to replay attacks when not using TLS encryption for transmission. - CVSS Score: 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N 3. CVE-2024-38824 - Description: A directory traversal vulnerability in the method allows arbitrary files to be written to the master cache directory. - CVSS Score: 9.6 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N 4. CVE-2024-38825 - Description: The module fails to properly validate the caller. The "password" field contains a public certificate for CA certificate verification, but the module does not perform PKI authentication. - CVSS Score: 6.4 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N 5. CVE-2025-22236 - Description: Minion event bus authorization bypass. An attacker with access to a minion key can craft a message to execute jobs on other minions (> 3007.0). - CVSS Score: 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L 6. CVE-2025-22237 - Description: An attacker with minion key access can exploit a specially crafted git URL to abuse the 'on demand' pillar functionality, leading to arbitrary command execution on the master with the same privileges as the master process. - CVSS Score: 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 7. CVE-2025-22238 - Description: Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to directory traversal, allowing attackers to write or overwrite files outside the cache directory. - CVSS Score: 4.2 AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N 8. CVE-2025-22239 - Description: Arbitrary event injection on Salt Master. The master's method can be exploited by authorized minions to send arbitrary events to the master's event bus. - CVSS Score: 8.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L 9. CVE-2025-22240 - Description: Arbitrary directory creation or file deletion. In the method of the GitFS class, the path is constructed using unvalidated input from the "tgt_env" variable. Attackers can exploit this to delete any file. - CVSS Score: 6.3 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H 10. CVE-2025-22241 - Description: File content overwrite via VirtKey class. Used when requesting "on-demand pillar" data, it creates a path to the "pki directory" using unvalidated input. This feature is used to automatically accept minion authentication keys based on a predefined "authorization file" at a specific location. - CVSS Score: 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N 11. CVE-2025-22242 - Description: Denial of service via file read operations. The master's method is exposed to all minions. The unvalidated input value "jid" is used to construct a path and then open for reading. Attackers can exploit this by attempting to read filenames that return no data, such as pipe nodes in the proc filesystem. - CVSS Score: 5.6 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H Additionally, this release includes SQLite 3.50.1 to address CVE-2025-29087 #68033.

Goal Reached Thanks to every supporter — we hit 100%!

Salt Security Bulletin: Multiple Vulnerabilities (CVE-2024-38822 to CVE-2025-22242) including RCE and Directory Traversal