In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is…
Priority MEDIUM 58CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Why it matters now
EPSS 0.15106 96th percentileScored 2026-11-07
Fix Fixed salt (PyPI): 2019.2.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2019.2.3 | 2019.2.3 | Patch available | GHSA-q53j-p6r2-g2v4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2019.2.3 Fixed in 2019.2.3 Patch available GHSA-q53j-p6r2-g2v4
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | up to 2019.2.0 | Vulnerable | SaltStack |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions up to 2019.2.0 Vulnerable ·SaltStack
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
Remediation
- Fix · GHSA-q53j-p6r2-g2v4 salt (PyPI) Fixed in 2019.2.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Ceph Storage 2
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17361
- 2026-10-03 Alias added: GHSA-q53j-p6r2-g2v4
References
Advisory 5
Sources
- CVE-2019-17361 · CVE Program
- CVE-2019-17361 · NVD
- FIRST EPSS
- GHSA-q53j-p6r2-g2v4 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-17361 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences