Read the docs
TI-2020-15613 Aliases CVE-2020-25592GHSA-29j3-2446-5j4w

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and…

Priority HIGH 76CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

Why it matters now

EPSS 0.57726 99th percentileScored 2026-11-07
Fix Partial salt (PyPI): 2015.8.13, 2016.3.8, 2016.11.10 +6Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—salt (PyPI)before 2015.8.132015.8.13Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)2016.3.0 to before 2016.3.82016.3.8Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)2016.11.0 to before 2016.11.102016.11.10Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)2017.5.0 to before 2017.7.82017.7.8Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)2018.2.0 to before 2018.3.52018.3.5Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)2019.2.0 to before 2019.2.72019.2.7Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)3000.0 to before 3000.53000.5Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)3001.0 to before 3001.33001.3Patch availableGHSA-29j3-2446-5j4w
—salt (PyPI)3002.0 to before 3002.13002.1Patch availableGHSA-29j3-2446-5j4w
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • salt (PyPI) Vendor— Affected before 2015.8.13 Fixed in 2015.8.13 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 2016.3.0 to before 2016.3.8 Fixed in 2016.3.8 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 2016.11.0 to before 2016.11.10 Fixed in 2016.11.10 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 2017.5.0 to before 2017.7.8 Fixed in 2017.7.8 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 2018.2.0 to before 2018.3.5 Fixed in 2018.3.5 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 2019.2.0 to before 2019.2.7 Fixed in 2019.2.7 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 3000.0 to before 3000.5 Fixed in 3000.5 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 3001.0 to before 3001.3 Fixed in 3001.3 Patch available GHSA-29j3-2446-5j4w
  • salt (PyPI) Vendor— Affected 3002.0 to before 3002.1 Fixed in 3002.1 Patch available GHSA-29j3-2446-5j4w

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.11.0 to before 2016.11.3; 2016.11.4 to before 2016.11.6; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.4; 2017.7.5 to before 2017.7.8; 2018.2.0 to before 2018.3.5; 2019.2.0 to before 2019.2.5; 3000.0 to before 3000.3VulnerableSaltStack
cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:*3001VulnerableSaltStack
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.11.0 to before 2016.11.3; 2016.11.4 to before 2016.11.6; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.4; 2017.7.5 to before 2017.7.8; 2018.2.0 to before 2018.3.5; 2019.2.0 to before 2019.2.5; 3000.0 to before 3000.3 Vulnerable ·SaltStack
  • cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:* Versions 3001 Vulnerable ·SaltStack
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 2015.8.13 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 2016.3.8 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 2016.11.10 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 2017.7.8 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 2018.3.5 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 2019.2.7 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 3000.5 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 3001.3 Advisory →
  • Fix · GHSA-29j3-2446-5j4w salt (PyPI) Fixed in 3002.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25592
  2. 2026-10-03 Alias added: GHSA-29j3-2446-5j4w

References

Advisory 9

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences