tocsin

PyPI/salt CVE-2021-3148: critical 9.8, EPSS 8.25%

SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

Action: Upgrade salt to 2015.8.13 or later.

pip install salt==2015.8.13
pip install salt==2016.11.5
pip install salt==2016.11.10
pip install salt==2017.7.8
pip install salt==2019.2.8
pip install salt==3000.7
pip install salt==3001.5
pip install salt==3002.3

Affected

introducedfixedlast affected
02015.8.13-
2016.3.02016.11.5-
2016.11.72016.11.10-
2017.5.02017.7.8-
2018.2.0-2018.3.5
2019.2.02019.2.8-
30003000.7-
30013001.5-
30023002.3-

Fixed versions

2015.8.132016.11.52016.11.102017.7.82019.2.83000.73001.53002.3

Sources

CVE-2021-3148 · published · modified · JSON