~ / search / GHSA-ghc2-hx3w-jqmp

GHSA-ghc2-hx3w-jqmp

SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-3148

Packages

EcosystemPackageAffectedFixed in
PyPI salt < 2015.8.13 2015.8.13
PyPI salt >= 2016.3.0, < 2016.11.5 2016.11.5
PyPI salt >= 2016.11.7, < 2016.11.10 2016.11.10
PyPI salt >= 2017.5.0, < 2017.7.8 2017.7.8
PyPI salt >= 2018.2.0, <= 2018.3.5 no fix listed
PyPI salt >= 2019.2.0, < 2019.2.8 2019.2.8
PyPI salt >= 3000, < 3000.7 3000.7
PyPI salt >= 3001, < 3001.5 3001.5
PyPI salt >= 3002, < 3002.3 3002.3

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in `salt.utils.thin.gen_thin()` command injection because of different handling of single versus double quotes. This is related to `salt/utils/thin.py`.

References

External links from the advisory. They lead to third-party sites.