tocsin

CVE-2021-3144

2 advisories.

PyPI/salt CVE-2021-3144: critical 9.1, EPSS 5.10%

SaltStack Salt eauth tokens can be used once after expiration

Action: Upgrade salt to 2015.8.13 or later.

pip install salt==2015.8.13
pip install salt==2016.11.5
pip install salt==2016.11.10
pip install salt==2017.7.8
pip install salt==3000.7
pip install salt==3001.5
pip install salt==3002.3
pip install salt==2019.2.8

Affected

introducedfixedlast affected
02015.8.13-
2016.3.02016.11.5-
2016.11.72016.11.10-
2017.5.02017.7.8-
2018.2.0-2018.3.5
30003000.7-
30013001.5-
30023002.3-
2019.2.02019.2.8-

Fixed versions

2015.8.132016.11.52016.11.102017.7.83000.73001.53002.32019.2.8

Sources

CVE-2021-3144 · published · modified · JSON

PyPI/salt CVE-2021-3144: unknown, EPSS 5.10%

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

Action: Upgrade salt to 2015.8.10 or later.

pip install salt==2015.8.10
pip install salt==2015.8.13
pip install salt==2016.3.4
pip install salt==2016.3.6
pip install salt==2016.3.8
pip install salt==2016.11.3
pip install salt==2016.11.5
pip install salt==2016.11.10
pip install salt==2017.7.8
pip install salt==2019.2.0rc1
pip install salt==2019.2.5
pip install salt==2019.2.8
pip install salt==3000.6
pip install salt==3001.4
pip install salt==3002.5

Affected

introducedfixedlast affected
02015.8.10-
2015.8.112015.8.13-
2016.3.02016.3.4-
2016.3.52016.3.6-
2016.3.72016.3.8-
2016.11.02016.11.3-
2016.11.42016.11.5-
2016.11.72016.11.10-
2017.7.02017.7.8-
2018.3.0rc12019.2.0rc1-
2019.2.02019.2.5-
2019.2.62019.2.8-
30003000.6-
30013001.4-
30023002.5-

Fixed versions

2015.8.102015.8.132016.3.42016.3.62016.3.82016.11.32016.11.52016.11.102017.7.82019.2.0rc12019.2.52019.2.83000.63001.43002.5

Sources

CVE-2021-3144 · published · modified · JSON