How to patch Salt by salt

CVE-2020-11651-11652.sls

{% if grains.saltversion == "2016.11.6" %}

# Just in case there is no patch command installed
patch:
  pkg.installed

# We use directory name here (saltpath) to apply patches that touch multiple files
saltmaster_security_patch:
  file.patch:
    - name: '{{ grains.saltpath }}'
    - source: salt://saltstack/files/salt-2016.11-security.patch
    - strip: 2
    - require:
        - pkg: patch

# Restart salt master after the patch is applied 
restart_salt_master:
  cmd.run:
    - name: 'salt-call service.restart salt-master'
    - bg: true
    - onchanges:
      - file: saltmaster_security_patch

{%- endif %}