critique
CVE-2021-25282
salt: Directory traversal in wheel.pillar_roots.write
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat5.1CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon GHSA (élevée), Red Hat (moyenne), Ubuntu (moyenne).
Description
An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | salt, salt3 | 2019.2.4-2.ph1 |
| Photon OS 3.0 | salt3 | 2019.2.8-3.ph3 |
| Photon OS 4.0 | salt3, salt3-api, salt3-cloud et 6 autres | 3003-1.ph4 |
| alpine 3.13 | salt | 3002.5-r0 |
| debian 10 | salt | 2018.3.4+dfsg1-6+deb10u3 |
| debian 9 | salt | 2016.11.2+ds-1+deb9u7 |
| pip::GitHub Security Advisory pip | salt | 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3 |
| Red Hat | salt, salt-minion | pas de correctif indiqué |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1+esm2 |
| ubuntu 18.04-ESM | salt | 2017.7.4+dfsg1-1ubuntu18.04.2+esm1 |
Afficher les 20 entrées de 10 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | salt | 2019.2.4-2.ph1 |
| Photon OS 1.0 | salt3 | 2019.2.4-2.ph1 |
| Photon OS 3.0 | salt3 | 2019.2.8-3.ph3 |
| Photon OS 4.0 | salt3 | 3003-1.ph4 |
| Photon OS 4.0 | salt3-api | 3003-1.ph4 |
| Photon OS 4.0 | salt3-cloud | 3003-1.ph4 |
| Photon OS 4.0 | salt3-master | 3003-1.ph4 |
| Photon OS 4.0 | salt3-minion | 3003-1.ph4 |
| Photon OS 4.0 | salt3-proxy | 3003-1.ph4 |
| Photon OS 4.0 | salt3-spm | 3003-1.ph4 |
| Photon OS 4.0 | salt3-ssh | 3003-1.ph4 |
| Photon OS 4.0 | salt3-syndic | 3003-1.ph4 |
| alpine 3.13 | salt | 3002.5-r0 |
| debian 10 | salt | 2018.3.4+dfsg1-6+deb10u3 |
| debian 9 | salt | 2016.11.2+ds-1+deb9u7 |
| pip::GitHub Security Advisory pip | salt | 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3 |
| Red Hat | salt | pas de correctif indiqué |
| Red Hat | salt-minion | pas de correctif indiqué |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1+esm2 |
| ubuntu 18.04-ESM | salt | 2017.7.4+dfsg1-1ubuntu18.04.2+esm1 |
Références
- http://packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html
- https://access.redhat.com/security/cve/CVE-2021-25282
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-51.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.7.rst#L31
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L31
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.3.rst#L31
- https://github.com/saltstack/salt/releases
Les 24 références
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://nvd.nist.gov/vuln/detail/CVE-2021-25282
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://ubuntu.com/security/notices/USN-6948-1
- https://www.cve.org/CVERecord?id=CVE-2021-25282
- https://www.debian.org/security/2021/dsa-5011