SB2025062340 - Fedora 43 update for salt
Published: June 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2024-38824)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error in recv_file method. A remote user can write arbitrary files to the master cache directory.
2) Insufficient verification of data authenticity (CVE-ID: CVE-2025-22239)
The vulnerability allows a local user to inject arbitrary events on Salt Master.
The vulnerability exists due to insufficient verification of data authenticity. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
3) Improper Authorization (CVE-ID: CVE-2025-22236)
The vulnerability allows a local user to impersonate other minions.
The vulnerability exists due to improper authorization. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions.
4) Input validation error (CVE-ID: CVE-2025-22242)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the pub_ret method. A local user can attempt to read from a filename that will not return any data and perform a denial of service (DoS) attack.
5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-22240)
The vulnerability allows a local user to manipulate with files and directories.
The vulnerability exists due to improper input validation in find_file method of the GitFS class. A local user can create arbitrary directories or delete any file on the Master's process without necessary permissions.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-22241)
The vulnerability allows a local user to bypass implemented security restrictions.
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
Remediation
Install update from vendor's website.