CVE-2021-3144
published 2021-02-27CVE-2021-3144: In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
PriorityP353critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
5.20%
91.4th percentile
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| saltstack | salt | < 2015.8.10 | 2015.8.10 |
| saltstack | salt | >= 0 < 2015.8.13 | 2015.8.13 |
| saltstack | salt | >= 0 < 2015.8.10 | 2015.8.10 |
| saltstack | salt | >= 2015.8.11 < 2015.8.13 | 2015.8.13 |
| saltstack | salt | >= 2015.8.11 < 2015.8.13 | 2015.8.13 |
| saltstack | salt | >= 2016.11.0 < 2016.11.3 | 2016.11.3 |
| saltstack | salt | >= 2016.11.4 < 2016.11.5 | 2016.11.5 |
| saltstack | salt | >= 2016.11.4 < 2016.11.5 | 2016.11.5 |
| saltstack | salt | >= 2016.11.7 < 2016.11.10 | 2016.11.10 |
| saltstack | salt | >= 2016.11.7 < 2016.11.10 | 2016.11.10 |
| saltstack | salt | >= 2016.3.0 < 2016.3.4 | 2016.3.4 |
| saltstack | salt | >= 2016.3.0 < 2016.11.5 | 2016.11.5 |
| saltstack | salt | >= 2016.3.0 < 2016.3.4 | 2016.3.4 |
| saltstack | salt | >= 2016.3.5 < 2016.3.6 | 2016.3.6 |
| saltstack | salt | >= 2016.3.5 < 2016.3.6 | 2016.3.6 |
| saltstack | salt | >= 2016.3.7 < 2016.3.8 | 2016.3.8 |
| saltstack | salt | >= 2016.3.7 < 2016.3.8 | 2016.3.8 |
| saltstack | salt | >= 2016.3.9 < 2016.11.3 | 2016.11.3 |
| saltstack | salt | >= 2017.5.0 < 2017.7.8 | 2017.7.8 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SaltStack Salt eauth tokens can be used once after expiration
osv·2022-05-24
CVE-2021-3144 [CRITICAL] SaltStack Salt eauth tokens can be used once after expiration
SaltStack Salt eauth tokens can be used once after expiration
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
GHSA
SaltStack Salt eauth tokens can be used once after expiration
ghsa·2022-05-24
CVE-2021-3144 [CRITICAL] CWE-613 SaltStack Salt eauth tokens can be used once after expiration
SaltStack Salt eauth tokens can be used once after expiration
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
OSV
CVE-2021-3144: In SaltStack Salt before 3002
osv·2021-02-27
CVE-2021-3144 CVE-2021-3144: In SaltStack Salt before 3002
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Red Hat
salt: eauth tokens can be used once after expiration
vendor_redhat·2021-02-25·CVSS 9.1
CVE-2021-3144 [CRITICAL] CWE-613 salt: eauth tokens can be used once after expiration
salt: eauth tokens can be used once after expiration
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
A flaw was found in Salt where tokens can be used once after expiration. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: Salt has been deprecated as of Red Hat Ceph Storage 2.5, as Salt was used to install RHSCON-2 and RHSCON-2 has reached End Of Life.
Package: salt (Red Hat Ceph Storage 2) - Will not fix
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/saltstack/salt/releaseshttps://lists.debian.org/debian-lts-announce/2021/11/msg00009.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/https://security.gentoo.org/glsa/202103-01https://security.gentoo.org/glsa/202310-22https://www.debian.org/security/2021/dsa-5011https://github.com/saltstack/salt/releaseshttps://lists.debian.org/debian-lts-announce/2021/11/msg00009.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/https://security.gentoo.org/glsa/202103-01https://security.gentoo.org/glsa/202310-22https://www.debian.org/security/2021/dsa-5011
2021-02-27
Published