salt (SUSE:Linux Enterprise Module for Server Applications 15 SP5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Server Applications 15 SP5 package salt, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2024-22232 — CVSS 7.7 (high): A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary…
• CVE-2023-34049 — CVSS 6.7 (medium): The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run…
• CVE-2023-28370 — CVSS 6.1 (medium): Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an…
• CVE-2023-20897 — CVSS 5.3 (medium): Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to…
• CVE-2024-22231 — CVSS 5.0 (medium): Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create…
• CVE-2023-20898 — CVSS 4.2 (medium): Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or…