{
  "cveId": "CVE-2019-17361",
  "url": "https://patchblox.com/security/cve/CVE-2019-17361",
  "summary": "CVE-2019-17361 is fixed in 8 products on 1 platform, first by salt-api 2017.7.4\u002Bdfsg1-1ubuntu18.04.2, released April 30, 2020. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "salt-api: In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection",
  "description": "In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.",
  "published": "2020-01-16T18:15:00Z",
  "severity": "Medium",
  "epss": 0.15106,
  "epssPercentile": 0.96757,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "salt-api",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-api 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-api-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-cloud",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-cloud 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-cloud-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-common",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-common 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-common-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-master",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-master 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-master-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-minion",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-minion 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-minion-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-proxy",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-proxy 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-proxy-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-ssh",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-ssh 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-ssh-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "salt-syndic",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "fix": "salt-syndic 2017.7.4\u002Bdfsg1-1ubuntu18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-salt-syndic-2017.7.4-dfsg1-1ubuntu18.04.2",
      "released": "2020-04-30T10:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}