PyPI/salt CVE-2015-4017: high 7.5, EPSS 1.08%

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.

Action: Upgrade salt to 2014.7.6 or later.

pip install salt==2014.7.6

Affected

Fixed versions

Sources

• osv: PYSEC-2017-31
• nvd: CVE-2015-4017
• https://docs.saltstack.com/en/latest/topics/releases/2014.7.6.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1222960
• http://www.openwall.com/lists/oss-security/2015/05/19/2
• https://groups.google.com/forum/#!topic/salt-users/8Kv1bytGD6c
• https://github.com/advisories/GHSA-8j9g-c9rp-jvg4

CVE-2015-4017 · published 2017-08-25T18:29:00Z · modified 2026-06-10T17:02:37.430614652Z · JSON