An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
References
Link | Resource |
---|---|
https://lists.debian.org/debian-lts-announce/2021/11/msg00017.html | Mailing List Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2021/11/msg00019.html | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/ | Mailing List Third Party Advisory |
https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/ | Patch Vendor Advisory |
https://security.gentoo.org/glsa/202310-22 | Third Party Advisory |
https://www.debian.org/security/2021/dsa-5011 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Dec 2023, 18:30
Type | Values Removed | Values Added |
---|---|---|
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/ - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/ - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/ - Mailing List, Third Party Advisory | |
References | (GENTOO) https://security.gentoo.org/glsa/202310-22 - Third Party Advisory |
07 Nov 2023, 03:30
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
31 Oct 2023, 14:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2021-09-08 15:15
Updated : 2024-02-28 18:48
NVD link : CVE-2021-21996
Mitre link : CVE-2021-21996
CVE.ORG link : CVE-2021-21996
JSON object : View
Products Affected
saltstack
- salt
debian
- debian_linux
fedoraproject
- fedora
CWE