Source: salt Version: 3002.6+dfsg1-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 2018.3.4+dfsg1-6+deb10u2 Control: found -1 2018.3.4+dfsg1-6
Hi, The following vulnerability was published for salt. CVE-2021-31607[0]: | In SaltStack Salt 2016.9 through 3002.6, a command injection | vulnerability exists in the snapper module that allows for local | privilege escalation on a minion. The attack requires that a file is | created with a pathname that is backed up by snapper, and that the | master calls the snapper.diff function (which executes popen | unsafely). If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-31607 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31607 [1] https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/ Please adjust the affected versions in the BTS as needed, but according to the reporte rall versions between 2016.9 through 3002.6 are affected. Regards, Salvatore