salt: CVE-2021-31607

Debian Bug report logs - #987496
salt: CVE-2021-31607

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: salt: CVE-2021-31607

Date: Sat, 24 Apr 2021 20:02:22 +0200

Source: salt
Version: 3002.6+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2018.3.4+dfsg1-6+deb10u2
Control: found -1 2018.3.4+dfsg1-6

Hi,

The following vulnerability was published for salt.

CVE-2021-31607[0]:
| In SaltStack Salt 2016.9 through 3002.6, a command injection
| vulnerability exists in the snapper module that allows for local
| privilege escalation on a minion. The attack requires that a file is
| created with a pathname that is backed up by snapper, and that the
| master calls the snapper.diff function (which executes popen
| unsafely).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-31607
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31607
[1] https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/

Please adjust the affected versions in the BTS as needed, but
according to the reporte rall versions between 2016.9 through 3002.6
are affected.

Regards,
Salvatore

Send a report that this bug log contains spam.