The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02501-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15: python3-salt / python3-salt-testsuite / salt / salt-api / etc (SUSE-SU-2025:02501-1)

high Nessus Plugin ID 242652

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jun 26, 2026, 4:08 PM Plugin metadata Plugin Feed: 202606261608
Version 1.2 Jan 21, 2026, 5:00 PM IAVM reference Plugin Feed: 202601211700
Version 1.1 Jul 24, 2025, 10:01 AM New Plugin Feed: 202507241001