GitHub Advisoryadvisory · PyPI

GHSA-hcjf-rp5h-g5h3 Command Injection in SaltStack Salt

HIGH Published 2022-05-24 Modified 2024-10-23 Official page ↗
Aliases
CVE-2021-31607
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2022-06-23

Affected packages

• PyPI salt: >= 2016.11.0, < 3003rc1 → fixed in 3003rc1

Description

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

Related

Alias · CVE (1)

  • CVE-2021-31607 In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References