2372631 – (CVE-2025-22239) CVE-2025-22239 salt: Event injection in saltstack

Bug 2372631 (CVE-2025-22239) - CVE-2025-22239 salt: Event injection in saltstack

Summary: CVE-2025-22239 salt: Event injection in saltstack

Keywords:
Status:	NEW
Alias:	CVE-2025-22239
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2372728 2372730 2372732 2372734
Blocks:
TreeView+	depends on / blocked

Reported:	2025-06-13 08:01 UTC by OSIDB Bzimport
Modified:	2025-06-13 17:31 UTC (History)
CC List:	0 users
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description OSIDB Bzimport 2025-06-13 08:01:08 UTC

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Note You need to log in before you can comment on or make changes to this bug.