critique
CVE-2021-25283
salt: Jinja renderer does not protect against server-side template injection attacks
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Red Hat (élevée), Ubuntu (moyenne).
Description
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | salt, salt3 | 2019.2.4-2.ph1 |
| Photon OS 3.0 | salt3 | 2019.2.8-3.ph3 |
| Photon OS 4.0 | salt3, salt3-api, salt3-cloud et 6 autres | 3003-1.ph4 |
| pip::GitHub Security Advisory pip | salt | 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.5 |
| alpine 3.13 | salt | 3002.5-r0 |
| debian 10 | salt | 2018.3.4+dfsg1-6+deb10u3 |
| debian 9 | salt | 2016.11.2+ds-1+deb9u7 |
| Red Hat | salt, salt-minion | pas de correctif indiqué |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1+esm2 |
| ubuntu 18.04-ESM | salt | 2017.7.4+dfsg1-1ubuntu18.04.2+esm1 |
Afficher les 20 entrées de 10 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | salt | 2019.2.4-2.ph1 |
| Photon OS 1.0 | salt3 | 2019.2.4-2.ph1 |
| Photon OS 3.0 | salt3 | 2019.2.8-3.ph3 |
| Photon OS 4.0 | salt3 | 3003-1.ph4 |
| Photon OS 4.0 | salt3-api | 3003-1.ph4 |
| Photon OS 4.0 | salt3-cloud | 3003-1.ph4 |
| Photon OS 4.0 | salt3-master | 3003-1.ph4 |
| Photon OS 4.0 | salt3-minion | 3003-1.ph4 |
| Photon OS 4.0 | salt3-proxy | 3003-1.ph4 |
| Photon OS 4.0 | salt3-spm | 3003-1.ph4 |
| Photon OS 4.0 | salt3-ssh | 3003-1.ph4 |
| Photon OS 4.0 | salt3-syndic | 3003-1.ph4 |
| pip::GitHub Security Advisory pip | salt | 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.5 |
| alpine 3.13 | salt | 3002.5-r0 |
| debian 10 | salt | 2018.3.4+dfsg1-6+deb10u3 |
| debian 9 | salt | 2016.11.2+ds-1+deb9u7 |
| Red Hat | salt | pas de correctif indiqué |
| Red Hat | salt-minion | pas de correctif indiqué |
| ubuntu 16.04-ESM | salt | 2015.8.8+ds-1ubuntu0.1+esm2 |
| ubuntu 18.04-ESM | salt | 2017.7.4+dfsg1-1ubuntu18.04.2+esm1 |
Références
- https://access.redhat.com/security/cve/CVE-2021-25283
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-52.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L34
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.5.rst#L12
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
Les 21 références
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://nvd.nist.gov/vuln/detail/CVE-2021-25283
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://ubuntu.com/security/notices/USN-6948-1
- https://www.cve.org/CVERecord?id=CVE-2021-25283
- https://www.debian.org/security/2021/dsa-5011