Vulnerability · Published Mar 3, 2021 · Assigned by suse
CVE-2021-25315salt-api unauthenticated remote code execution
Critical 9.8
In plain English
A critical-severity improper authentication in Tumbleweed from openSUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | salt | 3002.2 | GHSA-pmj6-9f8c-8g2m |
| PyPI | salt | 3002.2 | PYSEC-2021-891 |
| Ubuntu:22.04:LTS | salt | no fix listed | UBUNTU-CVE-2021-25315 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SUSE | SUSE Linux Enterprise Server 15 SP 3 | salt – before 3002.2-3 |
| openSUSE | Tumbleweed | salt – through 3002.2-2.1 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H