CVE catalog
CVE-2016-9639
Recommended update for Salt
- Severity
- Critical · CVSS 9.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.60% · Oct 25, 2026
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | salt | pro | 0.16.0-1 | vulnerable |
| Ubuntu | salt | pro | 0.16.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.1+dfsg-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-3 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.5-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm4 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm5 | vulnerable |
| Ubuntu | salt | pro | 2015.5.3+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.1+ds-2 | vulnerable |
| Ubuntu | salt | pro | 2015.8.3+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.3+ds-2 | vulnerable |
| Ubuntu | salt | pro | 2015.8.3+ds-3 | vulnerable |
| Ubuntu | salt | pro | 2015.8.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.7+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1+esm1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1+esm2 | vulnerable |
| Suse | salt | enterprise storage 4 | 2015.8.12-27.5 | fixed |
| Suse | osad | linux enterprise server 11 sp3-client-tools | 5.11.64.3-5.1 | fixed |
| Suse | salt | linux enterprise server 11 sp3-client-tools | 2015.8.12-27.1 | fixed |
| Suse | spacewalk-backend | linux enterprise server 11 sp3-client-tools | 2.5.24.7-16.1 | fixed |
| Suse | supportutils-plugin-susemanager-client | linux enterprise server 11 sp3-client-tools | 3.0.5-5.1 | fixed |
| Suse | osad | linux enterprise server 11 sp4-client-tools | 5.11.64.3-5.1 | fixed |
| Suse | salt | linux enterprise server 11 sp4-client-tools | 2015.8.12-27.1 | fixed |
| Suse | spacewalk-backend | linux enterprise server 11 sp4-client-tools | 2.5.24.7-16.1 | fixed |
| Suse | supportutils-plugin-susemanager-client | linux enterprise server 11 sp4-client-tools | 3.0.5-5.1 | fixed |
| Suse | salt | manager client tools 12 | 2015.8.12-27.5 | fixed |
| Suse | salt | linux enterprise point of sale 12 sp2 | 2015.8.12-27.5 | fixed |
| Suse | salt | manager proxy 3.0 | 2015.8.12-27.5 | fixed |
| Suse | salt | manager server 3.0 | 2015.8.12-27.5 | fixed |
| Suse | salt | enterprise storage 3 | 2015.8.12-27.5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Suse | salt | rpm | enterprise storage 4 | 2015.8.12-27.5 | Not reported | SUSE-RU-2017:0171-1 | Not reported |
| Suse | osad | rpm | linux enterprise server 11 sp3-client-tools | 5.11.64.3-5.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 11 sp3-client-tools | 2015.8.12-27.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | spacewalk-backend | rpm | linux enterprise server 11 sp3-client-tools | 2.5.24.7-16.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | supportutils-plugin-susemanager-client | rpm | linux enterprise server 11 sp3-client-tools | 3.0.5-5.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | osad | rpm | linux enterprise server 11 sp4-client-tools | 5.11.64.3-5.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 11 sp4-client-tools | 2015.8.12-27.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | spacewalk-backend | rpm | linux enterprise server 11 sp4-client-tools | 2.5.24.7-16.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | supportutils-plugin-susemanager-client | rpm | linux enterprise server 11 sp4-client-tools | 3.0.5-5.1 | Not reported | SUSE-RU-2017:0174-1 | Not reported |
| Suse | salt | rpm | manager client tools 12 | 2015.8.12-27.5 | Not reported | SUSE-RU-2017:0169-1 | Not reported |
| Suse | salt | rpm | linux enterprise point of sale 12 sp2 | 2015.8.12-27.5 | Not reported | SUSE-RU-2017:0169-1 | Not reported |
| Suse | salt | rpm | manager proxy 3.0 | 2015.8.12-27.5 | Not reported | SUSE-RU-2017:0169-1 | Not reported |
| Suse | salt | rpm | manager server 3.0 | 2015.8.12-27.5 | Not reported | SUSE-RU-2017:0169-1 | Not reported |
| Suse | salt | rpm | enterprise storage 3 | 2015.8.12-27.5 | Not reported | SUSE-RU-2017:0169-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-ru-2017_0169-1.json]
- [https://osv.dev/vulnerability/SUSE-RU-2017:0169-1]
- [https://osv.dev/vulnerability/SUSE-RU-2017:0171-1]
- [https://osv.dev/vulnerability/SUSE-RU-2017:0174-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2016-9639]
- [https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-9639.json]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]