Vulnerability · Published Jun 13, 2025 · Assigned by vmware
CVE-2025-22242CVE-2025-22242 salt advisory
Medium 5.6
In plain English
A medium-severity uncontrolled resource consumption in SALT from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | salt | 3007.4 | GHSA-989c-m532-p2hv |
| PyPI | salt | 3006.12 | GHSA-989c-m532-p2hv |
| PyPI | salt | 3006.12, 3007.4 | PYSEC-2026-1896 |
| Ubuntu:22.04:LTS | salt | no fix listed | UBUNTU-CVE-2025-22242 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H