These release notes are for an old release of Salt. This release might contain known security and other issues that are fixed in the latest release.

Salt 3001.3 Release Notes¶

Version 3001.3 is a CVE fix release for 3001.

Fixed¶

Properly validate eauth credentials and tokens along with their ACLs. Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api. Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls to Salt ssh. (CVE-2020-25592)

Generated on October 23, 2024 at 09:06:04 UTC.

You are viewing docs built from a recent snapshot of the master branch. Switch to docs for the latest stable release, 3007.1.