Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a5d73a0399 advisory.

    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753


    ----

    - Resolves RHBZ#2366381
    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-31a7eefb8f advisory.

    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-551aed076e advisory.

    Automatic update for salt-3007.4-2.fc43.

    ##### **Changelog**

    ```
    * Thu Jun 19 2025 Robby Callicotte <rcallicotte@fedoraproject.org> - 3007.4-2
    - Updated sources
    * Thu Jun 19 2025 Robby Callicotte <rcallicotte@fedoraproject.org> - 3007.4-1
    - Update to 3007.4 RHBZ#2366381 - Resolves CVE-2024-38824 RHBZ#2372731 -       Resolves CVE-2024-38824 RHBZ#2372733 - Resolves CVE-2025-22239       RHBZ#2372732 - Resolves CVE-2025-22239 RHBZ#2372734 - Resolves       CVE-2025-22236 RHBZ#2372774 - Resolves CVE-2025-22236 RHBZ#2372776 -       Resolves CVE-2025-22242 RHBZ#2372741 - Resolves CVE-2025-22242       RHBZ#2372745 - Resolves CVE-2025-22240 RHBZ#2372746 - Resolves       CVE-2025-22241 RHBZ#2372748 - Resolves CVE-2025-22240 RHBZ#2372752 -       Resolves CVE-2025-22241 RHBZ#2372753

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities, including the following:

  - Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master     cache directory. (CVE-2024-38824)

  - Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which     may be able to execute a job on other minions (>= 3007.0). (CVE-2025-22236)

  - Arbitrary event injection on Salt Master. The master's _minion_event method can be used by and authorized     minion to send arbitrary events onto the master's event bus. (CVE-2025-22239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

ID	Name	Product	Family	Severity
241074	Fedora 42 : salt (2025-a5d73a0399)	Nessus	Fedora Local Security Checks	critical
240915	Fedora 41 : salt (2025-31a7eefb8f)	Nessus	Fedora Local Security Checks	critical
240193	Fedora 43 : salt (2025-551aed076e)	Nessus	Fedora Local Security Checks	critical
240180	SaltStack 3000 < 3006.12 / 3007 < 3007.4 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-22242

medium

Tenable Plugins

critical

critical

critical

critical