{"action":"Upgrade salt to 3003.3 or later.","affected":[{"fixed":"3003.3","introduced":"0"}],"component":"salt","cve_ids":["CVE-2021-21996"],"ecosystem":"PyPI","epss":0.03514,"exploited":false,"fixed_versions":["3003.3"],"ghsa_id":"GHSA-pf7h-h2wq-m7pg","id":"tcs_01M5KGCAXET4QFBAMGR322AN92","modified_at":"2023-11-08T04:04:53.223395Z","published_at":"2021-09-08T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-318","https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/","https://github.com/advisories/GHSA-pf7h-h2wq-m7pg"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-318","url":"https://osv.dev/vulnerability/PYSEC-2021-318"}],"summary":"An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion."}