CVE catalog

CVE-2019-17361

Recommended update for Salt

[CVE catalog]

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
15.16% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntuprosalt0.16.0-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.16.4-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.1+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.2-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.2-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.2-3UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.4-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.4-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm4UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]

Showing 12 observations. All 49 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debian10salt2018.3.4+dfsg1-6UnknownSource applicability is not established[DSA-4676-1]
Debian10salt2018.3.4+dfsg1-6+deb10u1UnknownSource applicability is not established[DSA-4676-1]
Debian9salt2016.11.2+ds-1UnknownSource applicability is not established[DSA-4676-1]
Debian9salt2016.11.2+ds-1+deb9u1UnknownSource applicability is not established[DSA-4676-1]
Debian9salt2016.11.2+ds-1+deb9u2UnknownSource applicability is not established[DSA-4676-1]
Debian9salt2016.11.2+ds-1+deb9u3UnknownSource applicability is not established[DSA-4676-1]
Opensuseleap 15.1salt2019.2.0-lp151.5.12.1UnknownSource applicability is not established[OPENSUSE-SU-2020:0357-1]
Suselinux enterprise high performance computing 15-espossalt2019.2.0-5.64.1UnknownSource applicability is not established[SUSE-RU-2020:0625-1]
Suselinux enterprise high performance computing 15-ltsssalt2019.2.0-5.64.1UnknownSource applicability is not established[SUSE-RU-2020:0625-1]
Suselinux enterprise module for advanced systems management 12salt2019.2.0-46.88.1UnknownSource applicability is not established[SUSE-RU-2020:0685-1]
Suselinux enterprise module for basesystem 15 sp1salt2019.2.0-6.24.1UnknownSource applicability is not established[SUSE-SU-2020:0684-1]
Suselinux enterprise module for python 2 15 sp1salt2019.2.0-6.24.1UnknownSource applicability is not established[SUSE-SU-2020:0684-1]
Suselinux enterprise module for server applications 15 sp1salt2019.2.0-6.24.1UnknownSource applicability is not established[SUSE-SU-2020:0684-1]
Suselinux enterprise point of sale 12 sp2salt2019.2.0-46.88.1UnknownSource applicability is not established[SUSE-RU-2020:0685-1]
Suselinux enterprise server 15-ltsssalt2019.2.0-5.64.1UnknownSource applicability is not established[SUSE-RU-2020:0625-1]
Suselinux enterprise server for sap applications 15salt2019.2.0-5.64.1UnknownSource applicability is not established[SUSE-RU-2020:0625-1]
Susemanager client tools 12salt2019.2.0-46.88.1UnknownSource applicability is not established[SUSE-RU-2020:0685-1]
Susemanager proxy 3.2salt2019.2.0-46.88.1UnknownSource applicability is not established[SUSE-RU-2020:0685-1]
Susemanager server 3.2salt2019.2.0-46.88.1UnknownSource applicability is not established[SUSE-RU-2020:0685-1]
Ubuntu16.04salt2015.5.3+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.1+ds-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.3+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.3+ds-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.3+ds-3UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.5+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.7+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.8+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu16.04salt2015.8.8+ds-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2016.11.5+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2016.11.8+dfsg1-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2017.7.2+dfsg1-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2017.7.3+dfsg1-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2017.7.4+dfsg1-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2017.7.4+dfsg1-1ubuntu18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntu18.04salt2017.7.4+dfsg1-1ubuntu18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.16.0-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.16.4-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.1+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.2-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.2-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.2-3UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.4-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.4-2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm2UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm4UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5+ds-1ubuntu0.1~esm5UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Ubuntuprosalt0.17.5-1UnknownSource applicability is not established[UBUNTU-CVE-2019-17361]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.16.0-1",
        "0.16.4-2",
        "0.17.1+dfsg-1",
        "0.17.2-1",
        "0.17.2-2",
        "0.17.2-3",
        "0.17.4-1",
        "0.17.4-2",
        "0.17.5-1",
        "0.17.5+ds-1",
        "0.17.5+ds-1ubuntu0.1~esm1",
        "0.17.5+ds-1ubuntu0.1~esm2",
        "0.17.5+ds-1ubuntu0.1~esm4",
        "0.17.5+ds-1ubuntu0.1~esm5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-17361",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-17361",
      "provider_updated_at": "2026-04-08T13:30:31.935880Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2015.8.8+ds-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2015.5.3+ds-1",
        "2015.8.1+ds-2",
        "2015.8.3+ds-1",
        "2015.8.3+ds-2",
        "2015.8.3+ds-3",
        "2015.8.5+ds-1",
        "2015.8.7+ds-1",
        "2015.8.8+ds-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-17361",
      "fixed_version": "2015.8.8+ds-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-17361",
      "provider_updated_at": "2026-04-08T13:30:31.935880Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2017.7.4+dfsg1-1ubuntu18.04.2"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2016.11.5+ds-1",
        "2016.11.8+dfsg1-1",
        "2017.7.2+dfsg1-2ubuntu1",
        "2017.7.3+dfsg1-1",
        "2017.7.4+dfsg1-1",
        "2017.7.4+dfsg1-1ubuntu18.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-17361",
      "fixed_version": "2017.7.4+dfsg1-1ubuntu18.04.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-17361",
      "provider_updated_at": "2026-04-08T13:30:31.935880Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2016.11.2+ds-1+deb9u3"
            }
          ]
        }
      ],
      "release": "9",
      "versions": [
        "2016.11.2+ds-1",
        "2016.11.2+ds-1+deb9u1",
        "2016.11.2+ds-1+deb9u2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DSA-4676-1",
      "fixed_version": "2016.11.2+ds-1+deb9u3",
      "provider_source": "pypi",
      "provider_record_id": "DSA-4676-1",
      "provider_updated_at": "2026-03-09T02:10:21.886313Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2018.3.4+dfsg1-6+deb10u1"
            }
          ]
        }
      ],
      "release": "10",
      "versions": [
        "2018.3.4+dfsg1-6"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DSA-4676-1",
      "fixed_version": "2018.3.4+dfsg1-6+deb10u1",
      "provider_source": "pypi",
      "provider_record_id": "DSA-4676-1",
      "provider_updated_at": "2026-03-09T02:10:21.886313Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-lp151.5.12.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:0357-1",
      "fixed_version": "2019.2.0-lp151.5.12.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:0357-1",
      "provider_updated_at": "2026-02-04T03:45:15.939882Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-5.64.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15-espos",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0625-1",
      "fixed_version": "2019.2.0-5.64.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0625-1",
      "provider_updated_at": "2026-02-04T03:37:51.627732Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-5.64.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0625-1",
      "fixed_version": "2019.2.0-5.64.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0625-1",
      "provider_updated_at": "2026-02-04T03:37:51.627732Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-5.64.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0625-1",
      "fixed_version": "2019.2.0-5.64.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0625-1",
      "provider_updated_at": "2026-02-04T03:37:51.627732Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-5.64.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0625-1",
      "fixed_version": "2019.2.0-5.64.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0625-1",
      "provider_updated_at": "2026-02-04T03:37:51.627732Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-6.24.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:0684-1",
      "fixed_version": "2019.2.0-6.24.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:0684-1",
      "provider_updated_at": "2026-02-04T03:34:11.195793Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-6.24.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for python 2 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:0684-1",
      "fixed_version": "2019.2.0-6.24.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:0684-1",
      "provider_updated_at": "2026-02-04T03:34:11.195793Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-6.24.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for server applications 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:0684-1",
      "fixed_version": "2019.2.0-6.24.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:0684-1",
      "provider_updated_at": "2026-02-04T03:34:11.195793Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-46.88.1"
            }
          ]
        }
      ],
      "release": "manager client tools 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0685-1",
      "fixed_version": "2019.2.0-46.88.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0685-1",
      "provider_updated_at": "2026-02-04T02:17:17.023436Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-46.88.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for advanced systems management 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0685-1",
      "fixed_version": "2019.2.0-46.88.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0685-1",
      "provider_updated_at": "2026-02-04T02:17:17.023436Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-46.88.1"
            }
          ]
        }
      ],
      "release": "linux enterprise point of sale 12 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0685-1",
      "fixed_version": "2019.2.0-46.88.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0685-1",
      "provider_updated_at": "2026-02-04T02:17:17.023436Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-46.88.1"
            }
          ]
        }
      ],
      "release": "manager proxy 3.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0685-1",
      "fixed_version": "2019.2.0-46.88.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0685-1",
      "provider_updated_at": "2026-02-04T02:17:17.023436Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2019.2.0-46.88.1"
            }
          ]
        }
      ],
      "release": "manager server 3.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2020:0685-1",
      "fixed_version": "2019.2.0-46.88.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2020:0685-1",
      "provider_updated_at": "2026-02-04T02:17:17.023436Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]