critical9.8
CVE-2021-25283
SaltStack Salt Server Side Template Injection
Impact
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | salt | < 2015.8.13 | 2015.8.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Saltstack | Salt | before 2015.8.10 from 2015.8.11 before 2015.8.13 from 2016.3.0 before 2016.3.4 from 2016.3.5 before 2016.3.6 from 2016.3.7 before 2016.3.8 from 2016.3.9 before 2016.11.3 |
| Fedoraproject | Fedora | Versions 32, 33, 34 |
| Debian | Debian Linux | Versions 9.0, 10.0, 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/saltstack/salt/releases
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- https://security.gentoo.org/glsa/202103-01
- https://security.gentoo.org/glsa/202310-22
- https://www.debian.org/security/2021/dsa-5011
- https://github.com/advisories/GHSA-xgmh-gfxw-2hvv
- https://nvd.nist.gov/vuln/detail/CVE-2021-25283
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L34
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.5.rst#L12
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-52.yaml