| Package | Affected versions | Patched versions |
|---|---|---|
| salt | ≥ 2015.8.11, < 2015.8.13≥ 2016.11.0, < 2016.11.3≥ 2016.11.4, < 2016.11.5≥ 2016.11.7, < 2016.11.10≥ 2016.3.0, < 2016.11.5≥ 2016.3.0, < 2016.3.4≥ 2016.3.5, < 2016.3.6≥ 2016.3.7, < 2016.3.8≥ 2017.5.0, < 2017.7.8≥ 2017.7.0, < 2017.7.8≥ 2018.2.0, ≤ 2018.3.5≥ 2018.3.0rc1, < 2019.2.0rc1≥ 2019.2.0, < 2019.2.5≥ 2019.2.0, < 2019.2.8≥ 2019.2.6, < 2019.2.8≥ 3000, < 3000.6≥ 3000, < 3000.7≥ 3001, < 3001.4≥ 3001, < 3001.5≥ 3002, < 3002.3≥ 3002, < 3002.5< 2015.8.10< 2015.8.13 | 2015.8.132016.11.32016.11.52016.11.102016.3.42016.3.62016.3.82017.7.82019.2.0rc12019.2.52019.2.83000.63000.73001.43001.53002.33002.52015.8.10 |
| salt | ≥ 2015.8.11, < 2015.8.13≥ 2016.11.4, < 2016.11.5≥ 2016.11.7, < 2016.11.10≥ 2016.3.0, < 2016.3.4≥ 2016.3.5, < 2016.3.6≥ 2016.3.7, < 2016.3.8≥ 2016.3.9, < 2016.11.3≥ 2017.5.0, < 2017.7.8≥ 2018.2.0, ≤ 2018.3.5≥ 2019.2.0, < 2019.2.5≥ 2019.2.6, < 2019.2.8≥ 3000, < 3000.6≥ 3001, < 3001.4≥ 3002, < 3002.5< 2015.8.10 | 2015.8.132016.11.52016.11.102016.3.42016.3.62016.3.82016.11.32017.7.82019.2.52019.2.83000.63001.43002.52015.8.10 |
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free