GitHub Advisoryadvisory · PyPI

GHSA-w2hr-3mc8-46gh SaltStack Salt eauth tokens can be used once after expiration

CRITICAL Published 2022-05-24 Modified 2024-10-23 Official page ↗
Aliases
CVE-2021-3144
Ecosystem
PyPI
Packages
salt
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-613
Reviewed
2024-04-22

Affected packages

• PyPI salt: < 2015.8.13 → fixed in 2015.8.13 • PyPI salt: >= 2016.3.0, < 2016.11.5 → fixed in 2016.11.5 • PyPI salt: >= 2016.11.7, < 2016.11.10 → fixed in 2016.11.10 • PyPI salt: >= 2017.5.0, < 2017.7.8 → fixed in 2017.7.8 • PyPI salt: >= 2018.2.0, <= 2018.3.5 (no fix yet) • PyPI salt: >= 3000, < 3000.7 → fixed in 3000.7 • PyPI salt: >= 3001, < 3001.5 → fixed in 3001.5 • PyPI salt: >= 3002, < 3002.3 → fixed in 3002.3 • PyPI salt: >= 2019.2.0, < 2019.2.8 → fixed in 2019.2.8

Description

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2021-3144 In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. vulnerability

References