CVE catalog
CVE-2020-11651
Security update for salt
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- Exploitation
- CISA Known Exploited Vulnerabilities
- EPSS
- 96.61% · Oct 25, 2026
It was discovered that Salt incorrectly validated method calls and sanitized paths. A remote attacker could possibly use this issue to access some methods without authentication. (CVE-2020-11651, CVE-2020-11652)
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | salt | pro | 0.16.0-1 | vulnerable |
| Ubuntu | salt | pro | 0.16.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.1+dfsg-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-3 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.5-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm2 | fixed |
| Debian | salt | 9 | 2016.11.2+ds-1 | vulnerable |
| Debian | salt | 9 | 2016.11.2+ds-1+deb9u1 | vulnerable |
| Debian | salt | 9 | 2016.11.2+ds-1+deb9u2 | vulnerable |
| Debian | salt | 9 | 2016.11.2+ds-1+deb9u3 | vulnerable |
| Debian | salt | 9 | 2016.11.2+ds-1+deb9u4 | fixed |
| Debian | salt | 8 | 2014.1.13+ds-3 | vulnerable |
| Debian | salt | 8 | 2014.1.13+ds-3+deb8u1 | fixed |
| Suse | salt | manager client tools 12 | 2019.2.0-46.91.1 | fixed |
| Suse | salt | linux enterprise module for advanced systems management 12 | 2019.2.0-46.91.1 | fixed |
| Suse | salt | linux enterprise point of sale 12 sp2 | 2019.2.0-46.91.1 | fixed |
| Suse | salt | manager proxy 3.2 | 2019.2.0-46.91.1 | fixed |
| Suse | salt | manager server 3.2 | 2019.2.0-46.91.1 | fixed |
| Ubuntu | salt | pro | 0.16.0-1 | vulnerable |
| Ubuntu | salt | pro | 0.16.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.1+dfsg-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-3 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.5-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm2 | fixed |
| Ubuntu | salt | 16.04 | 2015.5.3+ds-1 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.1+ds-2 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.3+ds-1 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.3+ds-2 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.3+ds-3 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.5+ds-1 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.7+ds-1 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.8+ds-1 | vulnerable |
| Ubuntu | salt | 16.04 | 2015.8.8+ds-1ubuntu0.1 | fixed |
| Ubuntu | salt | 18.04 | 2016.11.5+ds-1 | vulnerable |
| Ubuntu | salt | 18.04 | 2016.11.8+dfsg1-1 | vulnerable |
| Ubuntu | salt | 18.04 | 2017.7.2+dfsg1-2ubuntu1 | vulnerable |
| Ubuntu | salt | 18.04 | 2017.7.3+dfsg1-1 | vulnerable |
| Ubuntu | salt | 18.04 | 2017.7.4+dfsg1-1 | vulnerable |
| Ubuntu | salt | 18.04 | 2017.7.4+dfsg1-1ubuntu18.04.1 | vulnerable |
| Ubuntu | salt | 18.04 | 2017.7.4+dfsg1-1ubuntu18.04.2 | fixed |
| Suse | salt | linux enterprise high performance computing 15-espos | 3000-5.78.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15-ltss | 3000-5.78.1 | fixed |
| Suse | salt | linux enterprise server 15-ltss | 3000-5.78.1 | fixed |
| Suse | salt | linux enterprise server for sap applications 15 | 3000-5.78.1 | fixed |
| Suse | python-singledispatch | manager client tools 12 | 3.4.0.3-1.5.1 | fixed |
| Suse | salt | manager client tools 12 | 3000-46.101.1 | fixed |
| Suse | python-singledispatch | linux enterprise module for advanced systems management 12 | 3.4.0.3-1.5.1 | fixed |
| Suse | salt | linux enterprise module for advanced systems management 12 | 3000-46.101.1 | fixed |
| Suse | python-singledispatch | linux enterprise point of sale 12 sp2 | 3.4.0.3-1.5.1 | fixed |
| Suse | salt | linux enterprise point of sale 12 sp2 | 3000-46.101.1 | fixed |
| Suse | python-singledispatch | manager proxy 3.2 | 3.4.0.3-1.5.1 | fixed |
| Suse | salt | manager proxy 3.2 | 3000-46.101.1 | fixed |
| Suse | python-singledispatch | manager server 3.2 | 3.4.0.3-1.5.1 | fixed |
| Suse | salt | manager server 3.2 | 3000-46.101.1 | fixed |
| Suse | salt | enterprise storage 5 | 2016.11.4-48.10.1 | fixed |
| Opensuse | salt | leap 15.1 | 2019.2.0-lp151.5.15.1 | fixed |
| Suse | salt | linux enterprise module for basesystem 15 sp1 | 2019.2.0-6.27.1 | fixed |
| Suse | salt | linux enterprise module for python 2 15 sp1 | 2019.2.0-6.27.1 | fixed |
| Suse | salt | linux enterprise module for server applications 15 sp1 | 2019.2.0-6.27.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15-espos | 2019.2.0-5.67.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15-ltss | 2019.2.0-5.67.1 | fixed |
| Suse | salt | linux enterprise server 15-ltss | 2019.2.0-5.67.1 | fixed |
| Suse | salt | linux enterprise server for sap applications 15 | 2019.2.0-5.67.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Ubuntu | salt | deb | pro | 0.17.5+ds-1ubuntu0.1~esm2 | Not reported | USN-6849-1 | Not reported |
| Debian | salt | deb | 9 | 2016.11.2+ds-1+deb9u4 | Not reported | DSA-4676-2 | Not reported |
| Debian | salt | deb | 8 | 2014.1.13+ds-3+deb8u1 | Not reported | DLA-2223-1 | Not reported |
| Suse | salt | rpm | manager client tools 12 | 2019.2.0-46.91.1 | Not reported | SUSE-SU-2020:1147-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for advanced systems management 12 | 2019.2.0-46.91.1 | Not reported | SUSE-SU-2020:1147-1 | Not reported |
| Suse | salt | rpm | linux enterprise point of sale 12 sp2 | 2019.2.0-46.91.1 | Not reported | SUSE-SU-2020:1147-1 | Not reported |
| Suse | salt | rpm | manager proxy 3.2 | 2019.2.0-46.91.1 | Not reported | SUSE-SU-2020:1147-1 | Not reported |
| Suse | salt | rpm | manager server 3.2 | 2019.2.0-46.91.1 | Not reported | SUSE-SU-2020:1147-1 | Not reported |
| Ubuntu | salt | deb | pro | 0.17.5+ds-1ubuntu0.1~esm2 | Not reported | UBUNTU-CVE-2020-11651 | Not reported |
| Ubuntu | salt | deb | 16.04 | 2015.8.8+ds-1ubuntu0.1 | Not reported | UBUNTU-CVE-2020-11651 | Not reported |
| Ubuntu | salt | deb | 18.04 | 2017.7.4+dfsg1-1ubuntu18.04.2 | Not reported | UBUNTU-CVE-2020-11651 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15-espos | 3000-5.78.1 | Not reported | SUSE-SU-2020:1973-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15-ltss | 3000-5.78.1 | Not reported | SUSE-SU-2020:1973-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15-ltss | 3000-5.78.1 | Not reported | SUSE-SU-2020:1973-1 | Not reported |
| Suse | salt | rpm | linux enterprise server for sap applications 15 | 3000-5.78.1 | Not reported | SUSE-SU-2020:1973-1 | Not reported |
| Suse | python-singledispatch | rpm | manager client tools 12 | 3.4.0.3-1.5.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | salt | rpm | manager client tools 12 | 3000-46.101.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | python-singledispatch | rpm | linux enterprise module for advanced systems management 12 | 3.4.0.3-1.5.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for advanced systems management 12 | 3000-46.101.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | python-singledispatch | rpm | linux enterprise point of sale 12 sp2 | 3.4.0.3-1.5.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | salt | rpm | linux enterprise point of sale 12 sp2 | 3000-46.101.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | python-singledispatch | rpm | manager proxy 3.2 | 3.4.0.3-1.5.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | salt | rpm | manager proxy 3.2 | 3000-46.101.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | python-singledispatch | rpm | manager server 3.2 | 3.4.0.3-1.5.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | salt | rpm | manager server 3.2 | 3000-46.101.1 | Not reported | SUSE-SU-2020:1971-1 | Not reported |
| Suse | salt | rpm | enterprise storage 5 | 2016.11.4-48.10.1 | Not reported | SUSE-SU-2020:1392-1 | Not reported |
| Opensuse | salt | rpm | leap 15.1 | 2019.2.0-lp151.5.15.1 | Not reported | OPENSUSE-SU-2020:0564-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for basesystem 15 sp1 | 2019.2.0-6.27.1 | Not reported | SUSE-SU-2020:1150-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for python 2 15 sp1 | 2019.2.0-6.27.1 | Not reported | SUSE-SU-2020:1150-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for server applications 15 sp1 | 2019.2.0-6.27.1 | Not reported | SUSE-SU-2020:1150-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15-espos | 2019.2.0-5.67.1 | Not reported | SUSE-SU-2020:1151-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15-ltss | 2019.2.0-5.67.1 | Not reported | SUSE-SU-2020:1151-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15-ltss | 2019.2.0-5.67.1 | Not reported | SUSE-SU-2020:1151-1 | Not reported |
| Suse | salt | rpm | linux enterprise server for sap applications 15 | 2019.2.0-5.67.1 | Not reported | SUSE-SU-2020:1151-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_1147-1.json]
- [https://osv.dev/vulnerability/DLA-2223-1]
- [https://osv.dev/vulnerability/DSA-4676-2]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1147-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1150-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1151-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1392-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1971-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1973-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-11651]
- [https://osv.dev/vulnerability/USN-6849-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2020:0564-1]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
[CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]