CVSS: 9.8EPSS: 16%CPEs: 21EXPL: 0CVE-2021-25283
https://notcve.org/view.php?id=CVE-2021-25283
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. Se detectó un problema por medio de SaltStack Salt versiones anteriores a 3002.5. El renderizador jinja no protege contra ataques de inyección de plantilla del lado del servidor • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-c • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.4EPSS: 0%CPEs: 21EXPL: 0CVE-2021-25284
https://notcve.org/view.php?id=CVE-2021-25284
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. Se detectó un problema por medio de SaltStack Salt versiones anteriores a 3002.5. salt.modules.cmdmod puede registrar credenciales para el nivel de registro de información o error • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT7 • CWE-522: Insufficiently Protected Credentials CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.1EPSS: 5%CPEs: 21EXPL: 0CVE-2021-3144
https://notcve.org/view.php?id=CVE-2021-3144
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) En SaltStack Salt versiones anteriores a 3002.5, los tokens de eauth pueden ser usados una vez después de su vencimiento. (Pueden ser usados para ejecutar un comando contra el maestro de sal o los minions) • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-c • CWE-613: Insufficient Session Expiration •
CVSS: 9.8EPSS: 5%CPEs: 21EXPL: 0CVE-2021-3148
https://notcve.org/view.php?id=CVE-2021-3148
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. Se detectó un problema en SaltStack Salt versiones anteriores a 3002.5. El envío de peticiones web diseñadas a la API de Salt puede resultar en una inyección del comando de la función salt.utils.thin.gen_thin() debido al manejo diferente de las comillas simples y las dobles. • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-c • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 84%CPEs: 21EXPL: 0CVE-2021-3197
https://notcve.org/view.php?id=CVE-2021-3197
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request. Se detectó un problema en SaltStack Salt versiones anteriores a 3002.5. El cliente ssh de salt-api es vulnerable a una inyección de shell al incluir ProxyCommand en un argumento, o por medio de ssh_options proporcionadas en una petición de API • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT7 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •