Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 41: salt 2025-31a7eefb8f critical: remote execution flaws

fedora
Calendar Grey June 29, 2025
Dist Fedora Esm H88
This memorandum outlines essential enhancements for Salt within Fedora 41, targeting various security vulnerabilities with significant consequences.
Resolves CVE-2024-38824 RHBZ#2372731 Resolves CVE-2024-38824 RHBZ#2372733 Resolves CVE-2025-22239 RHBZ#2372732 Resolves CVE-2025-22239 RHBZ#2372734 Resolves CVE-2025-22236 RHBZ#237...

Summary

Salt is a distributed remote execution system used to execute commands and

query data. It was developed in order to bring the best solutions found in

the world of remote execution together and make them better, faster and more

malleable. Salt accomplishes this via its ability to handle larger loads of

information, and not just dozens, but hundreds or even thousands of individual

servers, handle them quickly and through a simple and manageable interface.

Update Information:

Resolves CVE-2024-38824 RHBZ#2372731 Resolves CVE-2024-38824 RHBZ#2372733 Resolves CVE-2025-22239 RHBZ#2372732 Resolves CVE-2025-22239 RHBZ#2372734 Resolves CVE-2025-22236 RHBZ#2372774 Resolves CVE-2025-22236 RHBZ#2372776 Resolves CVE-2025-22242 RHBZ#2372741 Resolves CVE-2025-22242 RHBZ#2372745 Resolves CVE-2025-22240 RHBZ#2372746 Resolves CVE-2025-22241 RHBZ#2372748 Resolves CVE-2025-22240 RHBZ#2372752 Resolves CVE-2025-22241 RHBZ#2372753

Topics%20covered

Topics Covered

security advisory fedora critical remote access salt execution system

Change Log

* Thu Jun 19 2025 Robby Callicotte - 3007.4-4 - Combined rpmvercmp and contextvars patches * Thu Jun 19 2025 Robby Callicotte - 3007.4-3 - Updated contextvars patch * Thu Jun 19 2025 Robby Callicotte - 3007.4-2 - Updated sources * Thu Jun 19 2025 Robby Callicotte - 3007.4-1 - Update to 3007.4 RHBZ#2366381 - Resolves CVE-2024-38824 RHBZ#2372731 - Resolves CVE-2024-38824 RHBZ#2372733 - Resolves CVE-2025-22239 RHBZ#2372732 - Resolves CVE-2025-22239 RHBZ#2372734 - Resolves CVE-2025-22236 RHBZ#2372774 - Resolves CVE-2025-22236 RHBZ#2372776 - Resolves CVE-2025-22242 RHBZ#2372741 - Resolves CVE-2025-22242 RHBZ#2372745 - Resolves CVE-2025-22240 RHBZ#2372746 - Resolves CVE-2025-22241 RHBZ#2372748 - Resolves CVE-2025-22240 RHBZ#2372752 - Resolves CVE-2025-22241 RHBZ#2372753 * Mon Jun 2 2025 Python Maint - 3007.2-3 - Rebuilt for Python 3.14 * Fri May 30 2025 Robby Callicotte - 3007.2-2 - Updated to 3007.2 * Fri May 30 2025 Robby Callicotte - 3007.2-1 - Updated to 3007.2 * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3007.1-3 - Drop call to %sysusers_create_compat * Sun Jan 19 2025 Fedora Release Engineering - 3007.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

References


[ 1 ] Bug #2372747 - CVE-2024-38823 salt: Replay attack in saltstack [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2372747 [ 2 ] Bug #2372751 - CVE-2024-38823 salt: Replay attack in saltstack [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2372751 [ 3 ] Bug #2372755 - CVE-2024-38825 salt: Authentication bypass in saltstack [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2372755 [ 4 ] Bug #2372756 - CVE-2024-38822 salt: Token validation errors in saltstack [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2372756 [ 5 ] Bug #2372757 - CVE-2024-38825 salt: Authentication bypass in saltstack [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2372757 [ 6 ] Bug #2372758 - CVE-2024-38822 salt: Token validation errors in saltstack [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2372758 [ 7 ] Bug #2372772 - CVE-2025-22238 salt: Directory traversal in salt project [fedora-41] htt...

Read the Full Advisory

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-31a7eefb8f' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: salt
Product: Fedora 41
Version: 3007.4
Release: 4.fc41
URL: https://saltproject.io/
Summary: A parallel remote execution system

Topics%20covered

Topics Covered

security advisory fedora critical remote access salt execution system

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here