Vulnerability · Published Sep 8, 2021 · Assigned by vmware
CVE-2021-21996
High 7.5
In plain English
A high-severity security flaw in Saltstack Salt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.5%top 10.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | salt | 3003.3 | GHSA-pf7h-h2wq-m7pg |
| PyPI | salt | 3003.3 | PYSEC-2021-318 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Saltstack Salt | Saltstack Salt (before 3003.3) |
References
- https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/
- FEDORA-2021-00ada7e667 vendor-advisory
- FEDORA-2021-93a7c8b7c6 vendor-advisory
- FEDORA-2021-158e9c6eb9 vendor-advisory
- DSA-5011 vendor-advisory
- [debian-lts-announce] 20211119 [SECURITY] [DLA 2823-1] salt security update mailing-list
- [debian-lts-announce] 20211121 [SECURITY] [DLA 2823-2] salt regression update mailing-list
- GLSA-202310-22 vendor-advisory