{
  "fix": "SUSE-SU-2025:02501-1",
  "url": "https://patchblox.com/security/fix/linux/suse-su-2025-02501-1",
  "summary": "SUSE-SU-2025:02501-1, released July 23, 2025, fixes 12 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.",
  "platform": "linux",
  "type": "advisory",
  "title": "Security update for 2 packages",
  "released": "2025-07-23T12:47:18Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2025-47287, high severity",
  "supported": true,
  "cveCount": 12,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.01063,
  "maxCvss": 7.5,
  "vendorAdvisory": "https://osv.dev/vulnerability/SUSE-SU-2025:02501-1",
  "appliesTo": [
    {
      "product": "salt",
      "productUrl": "https://patchblox.com/security/product/linux/salt",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3006.0-150500.4.55.1",
      "supported": true
    },
    {
      "product": "salt",
      "productUrl": "https://patchblox.com/security/product/linux/salt",
      "release": "sles 15.6",
      "fixedVersion": "3006.0-150500.4.55.1",
      "supported": true
    },
    {
      "product": "salt-test",
      "productUrl": "https://patchblox.com/security/product/linux/salt-test",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3006.0-150500.4.55.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2025-47287",
      "url": "https://patchblox.com/security/cve/CVE-2025-47287",
      "title": "python-tornado: excessive logging when parsing malformed \u0060multipart/form-data\u0060 can lead to a denial-of-service",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.5,
      "epss": 0.00745,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-38824",
      "url": "https://patchblox.com/security/cve/CVE-2024-38824",
      "title": "salt: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)",
      "priority": "Routine",
      "epss": 0.01063,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22238",
      "url": "https://patchblox.com/security/cve/CVE-2025-22238",
      "title": "salt: Fixed the master\u0027s default cache vulnerability to a directory traversal attack (bsc#1244572)",
      "priority": "Routine",
      "epss": 0.00299,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-38822",
      "url": "https://patchblox.com/security/cve/CVE-2024-38822",
      "title": "salt: Fixed Minion token validation (bsc#1244561)",
      "priority": "Routine",
      "epss": 0.00269,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-38823",
      "url": "https://patchblox.com/security/cve/CVE-2024-38823",
      "title": "salt: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)",
      "priority": "Routine",
      "epss": 0.00269,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22241",
      "url": "https://patchblox.com/security/cve/CVE-2025-22241",
      "title": "salt: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)",
      "priority": "Routine",
      "epss": 0.00191,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22239",
      "url": "https://patchblox.com/security/cve/CVE-2025-22239",
      "title": "salt: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)",
      "priority": "Routine",
      "epss": 0.00189,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22237",
      "url": "https://patchblox.com/security/cve/CVE-2025-22237",
      "title": "salt: Fixed exploitation of the \u0027on demand\u0027 pillar functionality (bsc#1244571)",
      "priority": "Routine",
      "epss": 0.00187,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22236",
      "url": "https://patchblox.com/security/cve/CVE-2025-22236",
      "title": "salt: Fixed Minion event bus authorization bypass (bsc#1244568)",
      "priority": "Routine",
      "epss": 0.00178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22240",
      "url": "https://patchblox.com/security/cve/CVE-2025-22240",
      "title": "salt: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)",
      "priority": "Routine",
      "epss": 0.0017,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-38825",
      "url": "https://patchblox.com/security/cve/CVE-2024-38825",
      "title": "salt: Fixed salt.auth.pki module authentication issue (bsc#1244566)",
      "priority": "Routine",
      "epss": 0.0016,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-22242",
      "url": "https://patchblox.com/security/cve/CVE-2025-22242",
      "title": "salt: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)",
      "priority": "Routine",
      "epss": 0.00146,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T19:49:26Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}