These release notes are for an old release of Salt. This release might contain known security and other issues that are fixed in the latest release.

# Salt 2018.3.5 Release Notes

Version 2018.3.5 is a CVE-fix release for 2018.3.0.

## Security Fix

CVE-2019-17361

With the Salt NetAPI enabled in addition to having a SSH roster defined, unauthenticated access is possible when specifying the client as SSH. Additionally, when the raw_shell option is specified any arbitrary command may be run on the Salt master when specifying SSH options.