CVE-2020-35662: SSL Certificate Validation Bypass in SaltStack Salt

salt Updated 02 Oct 2025

Summary

27/02/2021

Disclosed on

CVE-2020-35662

CVE

Yes i

Fix available

High

Severity

7.4

CVSS Score

CVE-2020-35662: In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. Affects salt across 15 version ranges.

< 2015.8.10 >= 2015.8.11, < 2015.8.13 >= 2016.3.0, < 2016.3.4 >= 2016.3.5, < 2016.3.6 >= 2016.3.7, < 2016.3.8 >= 2016.11.0, < 2016.11.3 >= 2016.11.4, < 2016.11.5 >= 2016.11.7, < 2016.11.10 >= 2017.7.0, < 2017.7.8 >= 2018.3.0rc1, < 2019.2.0rc1 >= 2019.2.0, < 2019.2.5 >= 2019.2.6, < 2019.2.8 >= 3000, < 3000.6 >= 3001, < 3001.4 >= 3002, < 3002.5

Fixed in 15 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

SaltStack Salt is an open-source configuration management and remote execution tool. It allows administrators to manage and automate the configuration of a large number of servers. SaltStack Salt supports various modules for authenticating to services. However, in versions before 3002.5, the SSL certificate is not always validated when using certain modules.

Vulnerability Detail

The vulnerability (CVE-2020-35662) in SaltStack Salt allows for the bypassing of SSL certificate validation. This means that when authenticating to services using specific modules, the SSL certificate is not properly checked for authenticity. Attackers could exploit this vulnerability to perform man-in-the-middle attacks, intercept sensitive data, or impersonate trusted services. The issue was identified on February 27, 2021, and affects versions prior to 3002.5.

How To Fix

Latest published version: 3008.3.0 as of 22 Oct 2026

pip install --upgrade "salt==3008.3.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2015.8.10 2015.8.10
```
pip install --upgrade "salt==2015.8.10"
```
>= 2015.8.11, < 2015.8.13 2015.8.13
```
pip install --upgrade "salt==2015.8.13"
```
>= 2016.3.0, < 2016.3.4 2016.3.4
```
pip install --upgrade "salt==2016.3.4"
```
>= 2016.3.5, < 2016.3.6 2016.3.6
```
pip install --upgrade "salt==2016.3.6"
```
>= 2016.3.7, < 2016.3.8 2016.3.8
```
pip install --upgrade "salt==2016.3.8"
```
>= 2016.11.0, < 2016.11.3 2016.11.3
```
pip install --upgrade "salt==2016.11.3"
```

Show all 15 release lines

>= 2016.11.4, < 2016.11.5 2016.11.5
```
pip install --upgrade "salt==2016.11.5"
```

>= 2016.11.7, < 2016.11.10 2016.11.10

pip install --upgrade "salt==2016.11.10"

>= 2017.7.0, < 2017.7.8 2017.7.8
```
pip install --upgrade "salt==2017.7.8"
```
>= 2018.3.0rc1, < 2019.2.0rc1 2019.2.0rc1
```
pip install --upgrade "salt==2019.2.0rc1"
```
>= 2019.2.0, < 2019.2.5 2019.2.5
```
pip install --upgrade "salt==2019.2.5"
```
>= 2019.2.6, < 2019.2.8 2019.2.8
```
pip install --upgrade "salt==2019.2.8"
```
>= 3000, < 3000.6 3000.6
```
pip install --upgrade "salt==3000.6"
```
>= 3001, < 3001.4 3001.4
```
pip install --upgrade "salt==3001.4"
```
>= 3002, < 3002.5 3002.5
```
pip install --upgrade "salt==3002.5"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading immediately is not feasible, a temporary workaround is to manually validate SSL certificates when using the affected modules. This can be done by implementing custom code to verify the certificate's authenticity before establishing a connection. Here is an example in Python using the requests library:

import requests

def validate_ssl_certificate(url):
    response = requests.get(url, verify='/path/to/certificate.pem')
    # Add custom validation logic here
    
    return response

Conclusion

In conclusion, the SSL certificate validation bypass vulnerability (CVE-2020-35662) in SaltStack Salt versions prior to 3002.5 poses a risk to the integrity and security of authentication to services. It is crucial to upgrade to the fixed version or implement the recommended workaround to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for salt →

FAQ

What is SaltStack Salt?

SaltStack Salt is an open-source configuration management and remote execution tool used for managing and automating the configuration of servers.

What is SSL certificate validation?

SSL certificate validation is the process of verifying the authenticity and integrity of an SSL certificate presented by a server. It ensures that the certificate is issued by a trusted certificate authority and that it has not been tampered with.

How does this vulnerability impact users?

This vulnerability allows attackers to bypass SSL certificate validation, potentially leading to man-in-the-middle attacks, data interception, or impersonation of trusted services. Users of SaltStack Salt versions prior to 3002.5 are at risk if they use the affected modules for authentication.

Has this vulnerability been fixed?

Yes, the vulnerability has been fixed in SaltStack Salt version 3002.5. It is recommended to upgrade to this version or later to ensure proper SSL certificate validation.

How can I upgrade SaltStack Salt to the fixed version?

To upgrade SaltStack Salt, follow the official upgrade instructions provided by SaltStack. These instructions will guide you through the process of updating to the latest version, which includes the necessary fixes for this vulnerability.

References

Related vulnerabilities

Recent vulnerabilities recorded for salt.

View all salt vulnerabilities →