CVE-2020-17490: Weak File Permissions in SaltStack Salt TLS Module

salt Updated 02 Oct 2025

Summary

06/11/2020

Disclosed on

CVE-2020-17490

CVE

Yes i

Fix available

Moderate

Severity

5.5

CVSS Score

CVE-2020-17490: The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. Affects salt across 13 version ranges.

< 2015.8.10 >= 2015.8.11, < 2015.8.13 >= 2016.3.0, < 2016.3.4 >= 2016.3.5, < 2016.3.6 >= 2016.3.7, < 2016.3.8 >= 2016.11.0, < 2016.11.3 >= 2016.11.4, < 2016.11.6 >= 2016.11.7, < 2016.11.10 >= 2017.7.0, < 2017.7.4 >= 2017.7.5, < 2017.7.8 >= 2018.3.0rc1, < 2018.3.5 >= 2019.2.0, < 2019.2.5 >= 3000, < 3000.3

Fixed in 13 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

SaltStack Salt is an open-source configuration management and remote execution framework. It is widely used for managing and automating infrastructure. The TLS module within SaltStack Salt is responsible for handling secure communication between Salt minions and the Salt master. This vulnerability (CVE-2020-17490) arises from the creation of certificates with weak file permissions.

Vulnerability Detail

The TLS module in SaltStack Salt through version 3002 generates certificates with weak file permissions. This means that the certificates are accessible to unauthorized users or processes. Attackers with access to these certificates can potentially compromise the secure communication between Salt minions and the Salt master. This vulnerability poses a significant risk to the confidentiality and integrity of the communication channel.

How To Fix

Latest published version: 3008.3.0 as of 22 Oct 2026

pip install --upgrade "salt==3008.3.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2015.8.10 2015.8.10
```
pip install --upgrade "salt==2015.8.10"
```
>= 2015.8.11, < 2015.8.13 2015.8.13
```
pip install --upgrade "salt==2015.8.13"
```
>= 2016.3.0, < 2016.3.4 2016.3.4
```
pip install --upgrade "salt==2016.3.4"
```
>= 2016.3.5, < 2016.3.6 2016.3.6
```
pip install --upgrade "salt==2016.3.6"
```
>= 2016.3.7, < 2016.3.8 2016.3.8
```
pip install --upgrade "salt==2016.3.8"
```
>= 2016.11.0, < 2016.11.3 2016.11.3
```
pip install --upgrade "salt==2016.11.3"
```

Show all 13 release lines

>= 2016.11.4, < 2016.11.6 2016.11.6
```
pip install --upgrade "salt==2016.11.6"
```

>= 2016.11.7, < 2016.11.10 2016.11.10

pip install --upgrade "salt==2016.11.10"

>= 2017.7.0, < 2017.7.4 2017.7.4
```
pip install --upgrade "salt==2017.7.4"
```
>= 2017.7.5, < 2017.7.8 2017.7.8
```
pip install --upgrade "salt==2017.7.8"
```
>= 2018.3.0rc1, < 2018.3.5 2018.3.5
```
pip install --upgrade "salt==2018.3.5"
```
>= 2019.2.0, < 2019.2.5 2019.2.5
```
pip install --upgrade "salt==2019.2.5"
```
>= 3000, < 3000.3 3000.3
```
pip install --upgrade "salt==3000.3"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, users can manually update the file permissions of the generated certificates to restrict access. The following code snippet demonstrates how to set the appropriate file permissions:

chmod 600 <certificate_file>

Conclusion

The weak file permissions vulnerability in the TLS module of SaltStack Salt (CVE-2020-17490) can be mitigated by upgrading to version 3002.3 or later. In the meantime, users can apply a temporary workaround by manually updating the file permissions of the generated certificates. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for salt →

FAQ

What is the impact of this vulnerability?

This vulnerability allows unauthorized users or processes to access the generated certificates, potentially compromising the secure communication between Salt minions and the Salt master.

Which versions of SaltStack Salt are affected?

The vulnerability affects SaltStack Salt versions prior to 3002.

Has this vulnerability been fixed?

Yes, the vulnerability has been fixed in SaltStack Salt version 3002.3 and later.

Are there any workarounds available?

Yes, users can manually update the file permissions of the generated certificates to restrict access.

Where can I find more information about this vulnerability?

You can find more information about this vulnerability in the SaltStack Salt advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/salt/PYSEC-2020-105.yaml

References

Related vulnerabilities

Recent vulnerabilities recorded for salt.

View all salt vulnerabilities →