CVE catalog

CVE-2024-38825

UBUNTU-

The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.

Severity: Medium · CVSS 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: Jan 1, 2024, 12:00:00 AM UTC
Updated: Apr 8, 2026, 2:36:20 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.15% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Ubuntupro	salt	`0.16.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.16.4-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.1+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.2-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.2-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.4-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.4-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm4`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC

Showing 12 observations. All 42 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Ubuntu22.04	salt	`3002.6+dfsg1-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3002.7+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3004+dfsg1-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3004+dfsg1-5`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3004+dfsg1-6ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3004+dfsg1-7`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3004+dfsg1-8`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntu22.04	salt	`3004.1+dfsg-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.16.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.16.4-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.1+dfsg-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.2-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.2-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.4-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.4-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm4`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5+ds-1ubuntu0.1~esm5`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`0.17.5-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.5.3+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.1+ds-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.3+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.3+ds-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.3+ds-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.5+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.7+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.8+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.8+ds-1ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.8+ds-1ubuntu0.1+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.8+ds-1ubuntu0.1+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2015.8.8+ds-1ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2016.11.5+ds-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2016.11.8+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2017.7.2+dfsg1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2017.7.3+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2017.7.4+dfsg1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2017.7.4+dfsg1-1ubuntu18.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2017.7.4+dfsg1-1ubuntu18.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC
Ubuntupro	salt	`2017.7.4+dfsg1-1ubuntu18.04.2+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2024-38825]Apr 8, 2026, 2:36:20 PM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.16.0-1",
        "0.16.4-2",
        "0.17.1+dfsg-1",
        "0.17.2-1",
        "0.17.2-2",
        "0.17.2-3",
        "0.17.4-1",
        "0.17.4-2",
        "0.17.5-1",
        "0.17.5+ds-1",
        "0.17.5+ds-1ubuntu0.1~esm1",
        "0.17.5+ds-1ubuntu0.1~esm2",
        "0.17.5+ds-1ubuntu0.1~esm4",
        "0.17.5+ds-1ubuntu0.1~esm5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-38825",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-38825",
      "provider_updated_at": "2026-04-08T14:36:20.724727Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2015.5.3+ds-1",
        "2015.8.1+ds-2",
        "2015.8.3+ds-1",
        "2015.8.3+ds-2",
        "2015.8.3+ds-3",
        "2015.8.5+ds-1",
        "2015.8.7+ds-1",
        "2015.8.8+ds-1",
        "2015.8.8+ds-1ubuntu0.1~esm1",
        "2015.8.8+ds-1ubuntu0.1",
        "2015.8.8+ds-1ubuntu0.1+esm1",
        "2015.8.8+ds-1ubuntu0.1+esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-38825",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-38825",
      "provider_updated_at": "2026-04-08T14:36:20.724727Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2016.11.5+ds-1",
        "2016.11.8+dfsg1-1",
        "2017.7.2+dfsg1-2ubuntu1",
        "2017.7.3+dfsg1-1",
        "2017.7.4+dfsg1-1",
        "2017.7.4+dfsg1-1ubuntu18.04.1",
        "2017.7.4+dfsg1-1ubuntu18.04.2",
        "2017.7.4+dfsg1-1ubuntu18.04.2+esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-38825",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-38825",
      "provider_updated_at": "2026-04-08T14:36:20.724727Z",
      "applicability_unknown": true
    },
    {
      "name": "salt",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3002.6+dfsg1-4",
        "3002.7+dfsg1-1",
        "3004+dfsg1-4",
        "3004+dfsg1-5",
        "3004+dfsg1-6ubuntu1",
        "3004+dfsg1-7",
        "3004+dfsg1-8",
        "3004.1+dfsg-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-38825",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-38825",
      "provider_updated_at": "2026-04-08T14:36:20.724727Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed: Oct 24, 2026, 9:52:43 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]