~ / search / GHSA-pf7h-h2wq-m7pg

GHSA-pf7h-h2wq-m7pg

Exposure of Resource to Wrong Sphere in salt

Source: GitHub Advisory Database (reviewed) High CVE-2021-21996

Packages

EcosystemPackageAffectedFixed in
PyPI salt < 3003.3 3003.3

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

References

External links from the advisory. They lead to third-party sites.