CVE-2021-21996
published 2021-09-08CVE-2021-21996: An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on…
PriorityP351high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
3.45%
87.5th percentile
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| saltstack | salt | < 3000.3 | 3000.3 |
| saltstack | salt | >= 0 < 3003.3 | 3003.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.1HIGHAV:N/AC:H/Au:S/C:C/I:C/A:C
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
salt: user having control of source and source_hash URLs leads to root access
vendor_redhat·2021-09-02·CVSS 7.5
CVE-2021-21996 [HIGH] CWE-668 salt: user having control of source and source_hash URLs leads to root access
salt: user having control of source and source_hash URLs leads to root access
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
An Exposure of Resource to Wrong Sphere flaw was found in Salt. This flaw allows a user who has control of the source and source_hash URLs to gain full file system access as root on a Salt minion.
Package: salt (Red Hat Ceph Storage 2) - Out of support scope
OSV
Exposure of Resource to Wrong Sphere in salt
osv·2021-11-21
CVE-2021-21996 [HIGH] Exposure of Resource to Wrong Sphere in salt
Exposure of Resource to Wrong Sphere in salt
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
GHSA
Exposure of Resource to Wrong Sphere in salt
ghsa·2021-11-21
CVE-2021-21996 [HIGH] CWE-668 Exposure of Resource to Wrong Sphere in salt
Exposure of Resource to Wrong Sphere in salt
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
OSV
CVE-2021-21996: An issue was discovered in SaltStack Salt before 3003
osv·2021-09-08
CVE-2021-21996 CVE-2021-21996: An issue was discovered in SaltStack Salt before 3003
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2021/11/msg00017.htmlhttps://lists.debian.org/debian-lts-announce/2021/11/msg00019.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/https://security.gentoo.org/glsa/202310-22https://www.debian.org/security/2021/dsa-5011https://lists.debian.org/debian-lts-announce/2021/11/msg00017.htmlhttps://lists.debian.org/debian-lts-announce/2021/11/msg00019.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/https://security.gentoo.org/glsa/202310-22https://www.debian.org/security/2021/dsa-5011
2021-09-08
Published