Code injection in Salt - CVE-2025-62348

Vulnerability identifier: #VU120228

CSH Severity: Medium

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-62348

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the junos module when parsing yaml files. A remote attacker can trick the victim into using a specially crafted yaml file and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Salt
SUSE Multi-Linux Manager Beta Client Tools for SUSE Liberty Linux 10, RHEL and
SUSE Manager Proxy 4.3
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Manager Retail Branch Server 4.3
SUSE Linux Enterprise Server 15 SP5
SUSE Liberty Linux 9.6
SUSE Multi-Linux Manager Beta Client Tools for SUSE Liberty Linux 9, RHEL and
SUSE Multi-Linux Manager Beta Client Tools for SUSE Liberty Linux 8, RHEL and
SUSE Multi-Linux Manager Client Tools for SUSE Liberty Linux 7, RHEL and
SUSE Multi-Linux Manager Client Tools for SUSE Liberty Linux 8, RHEL and
SUSE Multi-Linux Manager Client Tools for SUSE Liberty Linux 9, RHEL and
SUSE Multi-Linux Manager Beta Client Tools for SUSE Liberty Linux 7, RHEL and
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Multi-Linux Manager Beta Client Tools for SLE Micro
SUSE Multi-Linux Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
SUSE Manager Client Tools for RHEL, Liberty and Clones
SUSE Manager Client Tools for SLE
SUSE Manager Client Tools for Debian
SUSE Multi-Linux Manager Client Tools for Debian
SUSE Multi-Linux Manager Beta Client Tools for Debian
SUSE Multi-Linux Manager Beta Client Tools for SLE
SUSE Multi-Linux Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
Transactional Server Module
Basesystem Module
Systems Management Module
Server Applications Module
openSUSE Leap
SUSE Manager Client Tools for Ubuntu 20.04
SUSE Manager Client Tools for Ubuntu 22.04
SUSE Multi-Linux Manager Client Tools for Ubuntu 22.04
SUSE Multi-Linux Manager Beta Client Tools for Ubuntu 22.04
SUSE Manager Client Tools for Ubuntu 24.04
SUSE Multi-Linux Manager Client Tools for Ubuntu 24.04
SUSE Multi-Linux Manager Beta Client Tools for Ubuntu 24.04
scap-security-guide-redhat
firewalld-prometheus-config
dracut-wireless
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
python-defusedxml
python3-defusedxml
prometheus-postgres_exporter
prometheus-postgres_exporter-debuginfo
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager-debuginfo
golang-github-prometheus-alertmanager
golang-github-lusitaniae-apache_exporter-debuginfo
golang-github-lusitaniae-apache_exporter
dracut-saltboot
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-prometheus-node_exporter-debuginfo
golang-github-boynux-squid_exporter
golang-github-boynux-squid_exporter-debuginfo
golang-github-prometheus-prometheus
golang-github-prometheus-prometheus-debuginfo
supportutils-plugin-susemanager-client
python2-mgr-push
python2-uyuni-common-libs
mgr-push
python3-mgr-push
python3-uyuni-common-libs
spacewalk-client-tools
python2-rhnlib
python2-spacewalk-client-tools
python3-rhnlib
python3-spacewalk-client-tools
mgrctl-fish-completion
mgrctl-zsh-completion
mgrctl
mgrctl-bash-completion
mgrctl-lang
mgrctl-debuginfo
spacecmd
Multi-Linux-ManagerTools-Beta-SLE-Micro-release
grafana-debuginfo
grafana
venv-salt-minion
salt-bash-completion
salt-zsh-completion
salt-fish-completion
salt-api
salt-cloud
python3-salt
salt-minion
salt-doc
salt
salt-proxy
salt-standalone-formulas-configuration
salt-ssh
salt-transactional-update
salt-master
salt-syndic
python3-salt-testsuite
python311-salt
python311-salt-testsuite

Install updates from vendor's website.

Salt - addressed in versions 3006.18, 3007.10
scap-security-guide-redhat - addressed in versions 0.1.79-80052.4.2.3, 0.1.79-90052.4.2.1
firewalld-prometheus-config - update to 0.1-159000.4.3.2
dracut-wireless - update to 0.1.1595937550.0285244-159000.2.2.1
kiwi-desc-saltboot - update to 0.1.1687520761.cefb248-150052.2.2.1
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150052.2.2.1, 0.4.0-159000.2.2.1
python-defusedxml - update to 0.6.0-150052.4.2.1
python3-defusedxml - update to 0.7.1-159000.4.2.1
prometheus-postgres_exporter - addressed in versions 0.10.1-150052.2.2.1, 0.10.1-159000.2.2.1
prometheus-postgres_exporter-debuginfo - addressed in versions 0.10.1-150052.2.2.1, 0.10.1-159000.2.2.1
prometheus-blackbox_exporter - update to 0.26.0-159000.2.2.1
golang-github-prometheus-alertmanager-debuginfo - update to 0.28.1-159000.12.2.1
golang-github-prometheus-alertmanager - update to 0.28.1-159000.12.2.1
golang-github-lusitaniae-apache_exporter-debuginfo - addressed in versions 1.0.10-150052.2.2.1, 1.0.10-159000.2.2.1
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.10-150052.2.2.1, 1.0.10-159000.2.2.1
dracut-saltboot - update to 1.1.0-159000.2.2.1
supportutils-plugin-salt - addressed in versions 1.2.3-150052.7.2.1, 1.2.3-159000.4.2.1
golang-github-prometheus-node_exporter - addressed in versions 1.9.1-70052.5.2.1, 1.9.1-80052.3.2.3, 1.9.1-90052.3.2.1, 1.9.1-150052.2.2.1, 1.9.1-159000.4.2.1
golang-github-prometheus-node_exporter-debuginfo - addressed in versions 1.9.1-150052.2.2.1, 1.9.1-159000.4.2.1
golang-github-boynux-squid_exporter - addressed in versions 1.13.0-150052.2.2.1, 1.13.0-159000.2.2.1
golang-github-boynux-squid_exporter-debuginfo - addressed in versions 1.13.0-150052.2.2.1, 1.13.0-159000.2.2.1
golang-github-prometheus-prometheus - update to 3.5.0-159000.4.3.2
golang-github-prometheus-prometheus-debuginfo - update to 3.5.0-159000.4.3.2
supportutils-plugin-susemanager-client - addressed in versions 5.2.2-150052.7.2.1, 5.2.2-159000.4.2.1
python2-mgr-push - addressed in versions 5.2.3-70052.3.3.1, 5.2.3-150052.2.3.1
python2-uyuni-common-libs - addressed in versions 5.2.3-70052.3.3.1, 5.2.3-150052.2.3.1
mgr-push - addressed in versions 5.2.3-70052.3.3.1, 5.2.3-150052.2.3.1, 5.2.3-159000.2.3.1
python3-mgr-push - update to 5.2.3-159000.2.3.1
python3-uyuni-common-libs - update to 5.2.3-159000.2.3.1
spacewalk-client-tools - addressed in versions 5.2.4-70052.3.3.1, 5.2.4-150052.53.4.1, 5.2.4-159000.4.3.1
python2-rhnlib - addressed in versions 5.2.4-70052.3.3.1, 5.2.4-150052.22.4.1
python2-spacewalk-client-tools - addressed in versions 5.2.4-70052.3.3.1, 5.2.4-150052.53.4.1
python3-rhnlib - update to 5.2.4-159000.4.3.1
python3-spacewalk-client-tools - update to 5.2.4-159000.4.3.1
mgrctl-fish-completion - addressed in versions 5.2.5-2.9.1, 5.2.5-2.9.3
mgrctl-zsh-completion - addressed in versions 5.2.5-2.9.1, 5.2.5-2.9.3, 5.2.5-80052.4.3.3, 5.2.5-90052.4.3.1, 5.2.5-150052.2.3.1, 5.2.5-159000.2.3.2
mgrctl - addressed in versions 5.2.5-2.9.1, 5.2.5-2.9.3, 5.2.5-80052.4.3.3, 5.2.5-90052.4.3.1, 5.2.5-150052.2.3.1, 5.2.5-159000.2.3.2
mgrctl-bash-completion - addressed in versions 5.2.5-2.9.1, 5.2.5-2.9.3, 5.2.5-80052.4.3.3, 5.2.5-90052.4.3.1, 5.2.5-150052.2.3.1, 5.2.5-159000.2.3.2
mgrctl-lang - addressed in versions 5.2.5-150052.2.3.1, 5.2.5-159000.2.3.2
mgrctl-debuginfo - update to 5.2.5-159000.2.3.2
spacecmd - addressed in versions 5.2.6-2.9.1, 5.2.6-2.9.2, 5.2.6-2.9.3, 5.2.6-70052.3.3.1, 5.2.6-80052.4.3.2, 5.2.6-90052.4.3.1, 5.2.6-100052.3.3.1, 5.2.6-150052.39.3.1, 5.2.6-159000.4.3.1
Multi-Linux-ManagerTools-Beta-SLE-Micro-release - update to 5-159000.3.3.1
grafana-debuginfo - update to 11.6.11-159000.2.3.2
grafana - update to 11.6.11-159000.2.3.2
venv-salt-minion - addressed in versions 3006.0-1.64.1, 3006.0-1.67.1, 3006.0-2.9.1, 3006.0-2.9.3, 3006.0-2.19.1, 3006.0-2.22.1, 3006.0-2.37.1, 3006.0-2.40.2, 3006.0-2.68.1, 3006.0-2.71.1, 3006.0-2.77.1, 3006.0-3.81.1, 3006.0-3.84.1, 3006.0-70002.5.6.1, 3006.0-80002.5.6.1, 3006.0-80052.6.3.2, 3006.0-90002.5.6.1, 3006.0-90052.6.3.1, 3006.0-100052.3.3.1, 3006.0-120002.3.14.2, 3006.0-120002.5.6.1, 3006.0-150000.3.83.1, 3006.0-150000.3.86.1, 3006.0-150002.5.6.1, 3006.0-150052.5.3.1, 3006.0-159000.5.3.2, 3006.0-220402.3.12.1, 3006.0-240402.3.12.1
salt-bash-completion - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-zsh-completion - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-fish-completion - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-api - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-cloud - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1
python3-salt - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1
salt-minion - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-doc - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-proxy - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-standalone-formulas-configuration - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-ssh - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-transactional-update - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-master - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
salt-syndic - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
python3-salt-testsuite - addressed in versions 3006.0-150300.53.101.1, 3006.0-150400.8.91.1, 3006.0-150500.4.65.1
python311-salt - addressed in versions 3006.0-150400.8.91.1, 3006.0-150500.4.65.1, 3006.0-150700.14.13.1
python311-salt-testsuite - addressed in versions 3006.0-150400.8.91.1, 3006.0-150500.4.65.1

• https://bugzilla.suse.com/show_bug.cgi?id=1254256
• https://github.com/saltstack/salt/issues/68469

• Multiple vulnerabilities in SaltStack Salt
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Client Tools
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Client Tools
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Client Tools
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Client Tools
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Client Tools
• SUSE update for Security update 5.1.1.1 for Multi-Linux Manager Client Tools
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.6 for Multi-Linux Manager Salt Bundle
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Salt Bundle
• SUSE update for Security update 5.0.7 for Multi-Linux Manager Salt Bundle
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools
• SUSE update for Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools