Skip to content
fr Sign in
6.4 Medium

CVE-2024-38825 The salt.auth.pki module does not properly authenticate callers

Description

The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.

Affected products and versions

Product Affected versions Fixed in
SALT 3007 3007.x → < 3007.4 3007.4
SALT 3006 3006.x → < 3006.12 3006.12

References

Timeline

  1. Published
  2. Last modified

Other CVEs of SALT

The 11 CVEs of SALT →
CVE-2024-38824 Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory 9.6 Critical CVE-2025-22242 Worker process denial of service through file read operation 5.6 Medium CVE-2025-22241 File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated… 5.6 Medium CVE-2025-22240 Arbitrary directory creation or file deletion 6.3 Medium
Track this CVE