{"action":"Upgrade salt to 3003rc1 or later.","affected":[{"fixed":"3003rc1","introduced":"2016.11.0"}],"component":"salt","cve_ids":["CVE-2021-31607"],"ecosystem":"PyPI","epss":0.05922,"exploited":false,"fixed_versions":["3003rc1"],"ghsa_id":"GHSA-hcjf-rp5h-g5h3","id":"tcs_01M5KGDVP3TYYZH3X2XR3ZT008","modified_at":"2023-11-08T04:05:50.055462Z","published_at":"2021-04-23T06:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-56","https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/","https://github.com/advisories/GHSA-hcjf-rp5h-g5h3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-56","url":"https://osv.dev/vulnerability/PYSEC-2021-56"}],"summary":"In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is creat"}