CVE-2015-4017: Salt - Certificate Verification Bypass
Summary
CVE-2015-4017: Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. Affects salt versions < 2014.7.6. Fixed in 2014.7.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Salt is a popular open-source configuration management and remote execution framework. It is used to automate the management and deployment of infrastructure. The framework allows administrators to define the desired state of their systems and Salt takes care of enforcing that state. Salt supports various modules for interacting with different systems, including aliyun, proxmox, and splunk.
Vulnerability Detail
Salt versions before 2014.7.6 are vulnerable to a certificate verification bypass when connecting via the aliyun, proxmox, and splunk modules. This means that Salt does not properly verify the authenticity of certificates presented by these modules, potentially allowing an attacker to perform man-in-the-middle attacks or impersonate a trusted server. This vulnerability could lead to unauthorized access, data leakage, or other malicious activities.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2014.7.6
This is the first release that contains the fix.
pip install --upgrade "salt==2014.7.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Salt is not immediately feasible, a temporary workaround is to disable or block the affected modules (aliyun, proxmox, and splunk) until the upgrade can be performed. This can be done by modifying the Salt configuration file to exclude or comment out the relevant module configurations.
Conclusion
In conclusion, Salt versions before 2014.7.6 are vulnerable to a certificate verification bypass when connecting via the aliyun, proxmox, and splunk modules. It is crucial to upgrade Salt to the latest version or apply the recommended workaround to mitigate the risk of unauthorized access or data leakage. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
Salt is an open-source configuration management and remote execution framework used for automating the management and deployment of infrastructure.
Salt versions before 2014.7.6 are affected by this vulnerability.
This vulnerability could allow an attacker to perform man-in-the-middle attacks or impersonate a trusted server, potentially leading to unauthorized access, data leakage, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade Salt to version 2014.7.6 or later. Alternatively, you can disable or block the affected modules (aliyun, proxmox, and splunk) until the upgrade can be performed.
You can find more information about this vulnerability in the official Salt documentation or by referring to the CVE-2015-4017 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
