Suse CVE-2025-22239

Immediate actions: (1) Disable or restrict access to the '_minion_event' RPC method if not required for your deployment (check /etc/salt/master configuration and reactor configuration), (2) Isolate Salt Master event bus access to trusted network segments, (3) Review Salt event reactor rules to identify which actions could be triggered by injected events and disable unnecessary reactors. Patch-based remediation: Update SaltStack Salt to the patched version (version number requires checking SaltProject's official CVE advisory at https://docs.saltproject.io/ or https://github.com/saltstack/salt/releases). Workarounds: (1) Implement strict input validation in custom event reactors on the master, (2) Use event ACLs or event tagging to distinguish trusted vs. minion-sourced events, (3) Monitor event bus for suspicious patterns using Salt's event logging capabilities ('salt-run state.event'), (4) Restrict minion authentication to necessary minions only and audit minion keys regularly. Long-term: Upgrade to Salt versions post-patch, review CWE-285 (improper authorization) patterns in custom Salt configurations, and implement event bus monitoring and alerting.