CVE-2025-22242
mediumPriorität · verfolgen · 0EPSS 0.001 · 3. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (60)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2025-1321SaltStack Salt: Mehrere SchwachstellenDeutsch2025-06-12csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SaltStack Salt ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren, beliebigen Programmcode auszuführen, einen Denial-of-Service auszulösen oder weitere nicht spezifizierte Auswirkungen zu erzielen.
- GHSA-989c-m532-p2hvSalt's worker process vulnerable to denial of service through file read operation2025-06-13ghsa · osvUS
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
- PYSEC-2026-1896Salt's worker process vulnerable to denial of service through file read operation2026-07-07vendor · osvUS
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.saltproject.io/en/3006/topics/releases/3006.12.htmlcnnvd
- https://docs.saltproject.io/en/3007/topics/releases/3007.4.htmlcnnvd
- https://packages.broadcom.com/artifactory/saltproject-generic/Patchcnnvd
- https://vigilance.fr/vulnerability/SaltStack-Salt-multiple-vulnerabilities-dated-12-06-2025-47421cnnvd
- https://docs.saltproject.io/en/3006/topics/releases/3006.12.htmlenisa_euvd
- https://docs.saltproject.io/en/3007/topics/releases/3007.4.htmlenisa_euvd
- https://docs.saltproject.io/en/3006/topics/releases/3006.12.htmlnvd
- https://docs.saltproject.io/en/3007/topics/releases/3007.4.htmlnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan