GHSA-phhw-3wc9-8q75 SaltStack Salt command injection via a crafted process name

• PyPI salt: < 2015.8.13 → fixed in 2015.8.13 • PyPI salt: >= 2016.3.0, < 2016.11.5 → fixed in 2016.11.5 • PyPI salt: >= 2016.11.7, < 2016.11.10 → fixed in 2016.11.10 • PyPI salt: >= 2017.5.0, < 2017.7.8 → fixed in 2017.7.8 • PyPI salt: >= 2018.2.0, <= 2018.3.5 (no fix yet) • PyPI salt: >= 2019.2.0, < 2019.2.8 → fixed in 2019.2.8 • PyPI salt: >= 3000, < 3000.7 → fixed in 3000.7 • PyPI salt: >= 3001, < 3001.5 → fixed in 3001.5 • PyPI salt: >= 3002, < 3002.3 → fixed in 3002.3

An issue was discovered in SaltStack Salt before 3002.5. The minion's `restartcheck` is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.