Remote Yes

Type Arbitrary filesystem access

Description

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

AVG-2354 salt 3003.2-1 3003.3-1 Medium Fixed

https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/