tocsin

PyPI/salt CVE-2021-3197: critical 9.8, EPSS 71.68%

SaltStack Salt is vulnerable to shell injection via ProxyCommand argument

Action: Upgrade salt to 2015.8.13 or later.

pip install salt==2015.8.13
pip install salt==2016.11.5
pip install salt==2016.11.10
pip install salt==2017.7.8
pip install salt==2019.2.8
pip install salt==3000.7
pip install salt==3001.5
pip install salt==3002.3

Affected

introducedfixedlast affected
02015.8.13-
2016.3.02016.11.5-
2016.11.72016.11.10-
2017.5.02017.7.8-
2018.2.0-2018.3.5
2019.2.02019.2.8-
30003000.7-
30013001.5-
30023002.3-

Fixed versions

2015.8.132016.11.52016.11.102017.7.82019.2.83000.73001.53002.3

Sources

CVE-2021-3197 · published · modified · JSON