PyPI/salt CVE-2021-31607: unknown, EPSS 5.92%

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is creat

Action: Upgrade salt to 3003rc1 or later.

pip install salt==3003rc1

Affected

Fixed versions

Sources

• osv: PYSEC-2021-56
• https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/
• https://github.com/advisories/GHSA-hcjf-rp5h-g5h3

CVE-2021-31607 · published 2021-04-23T06:15:00Z · modified 2023-11-08T04:05:50.055462Z · JSON