Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is     created using os.path.join using unvalidated input from the tgt_env variable. This can be exploited by     an attacker to delete any file on the Master's process has permissions to. (CVE-2025-22240)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02534-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02502-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02476-1 advisory.

    release-notes-susemanager-proxy:

    - Update to SUSE Manager 4.3.16
      * CVE Fixed         CVE-2025-23392, CVE-2025-23393, CVE-2025-46809
      * Bugs mentioned:
        bsc#1236601, bsc#1236635, bsc#1236779, bsc#1237294, bsc#1238922         bsc#1239826, bsc#1240386, bsc#1242004, bsc#1243460, bsc#1245222         bsc#1245005

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02500-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02492-1 advisory.

    venv-salt-minion:

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies
      - Fixed VIRTUAL_ENV variable in activate file to point to actual path
      - Fixed the bundle path in pyvenv.cfg
      - Prevent tests failures when pygit2 is not present

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02501-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a5d73a0399 advisory.

    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753


    ----

    - Resolves RHBZ#2366381
    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-31a7eefb8f advisory.

    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-551aed076e advisory.

    Automatic update for salt-3007.4-2.fc43.

    ##### **Changelog**

    ```
    * Thu Jun 19 2025 Robby Callicotte <rcallicotte@fedoraproject.org> - 3007.4-2
    - Updated sources
    * Thu Jun 19 2025 Robby Callicotte <rcallicotte@fedoraproject.org> - 3007.4-1
    - Update to 3007.4 RHBZ#2366381 - Resolves CVE-2024-38824 RHBZ#2372731 -       Resolves CVE-2024-38824 RHBZ#2372733 - Resolves CVE-2025-22239       RHBZ#2372732 - Resolves CVE-2025-22239 RHBZ#2372734 - Resolves       CVE-2025-22236 RHBZ#2372774 - Resolves CVE-2025-22236 RHBZ#2372776 -       Resolves CVE-2025-22242 RHBZ#2372741 - Resolves CVE-2025-22242       RHBZ#2372745 - Resolves CVE-2025-22240 RHBZ#2372746 - Resolves       CVE-2025-22241 RHBZ#2372748 - Resolves CVE-2025-22240 RHBZ#2372752 -       Resolves CVE-2025-22241 RHBZ#2372753

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities, including the following:

  - Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master     cache directory. (CVE-2024-38824)

  - Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which     may be able to execute a job on other minions (>= 3007.0). (CVE-2025-22236)

  - Arbitrary event injection on Salt Master. The master's _minion_event method can be used by and authorized     minion to send arbitrary events onto the master's event bus. (CVE-2025-22239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is
    created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by
    an attacker to delete any file on the Master's process has permissions to. (CVE-2025-22240)

ID	Name	Product	Family	Severity
261179	Linux Distros Unpatched Vulnerability : CVE-2025-22240	Nessus	Misc.	medium
242955	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2025:02534-1)	Nessus	SuSE Local Security Checks	high
242657	SUSE SLES15: python311-salt / salt / salt-api / salt-bash-completion / salt-doc / etc (SUSE-SU-2025:02502-1)	Nessus	SuSE Local Security Checks	high
242656	SUSE SLES15 : Security update 4.3.16 for Multi-Linux Manager Proxy and Retail Branch Server (SUSE-SU-2025:02476-1)	Nessus	SuSE Local Security Checks	medium
242654	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2025:02500-1)	Nessus	SuSE Local Security Checks	high
242653	SUSE SLES15 : Security update 5.0.5 for Multi-Linux Manager Salt Bundle (SUSE-SU-2025:02492-1)	Nessus	SuSE Local Security Checks	high
242652	SUSE SLED15: python3-salt / python3-salt-testsuite / salt / salt-api / etc (SUSE-SU-2025:02501-1)	Nessus	SuSE Local Security Checks	high
241074	Fedora 42 : salt (2025-a5d73a0399)	Nessus	Fedora Local Security Checks	critical
240915	Fedora 41 : salt (2025-31a7eefb8f)	Nessus	Fedora Local Security Checks	critical
240193	Fedora 43 : salt (2025-551aed076e)	Nessus	Fedora Local Security Checks	critical
240180	SaltStack 3000 < 3006.12 / 3007 < 3007.4 Multiple Vulnerabilities	Nessus	Misc.	critical
427877	SCA: security update for salt (GHSA-xh32-3m67-qjgf)	Tenable Cloud Security	SCA Checks	medium
427877	SCA: security update for salt (GHSA-xh32-3m67-qjgf)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-22240

medium

Tenable Plugins

medium

high

high

medium

high

high

high

critical

critical

critical

critical

medium

medium