A salt security update has been released for Debian GNU/Linux 9 to address multiple security issues, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.