CVSS: 9.1EPSS: 5%CPEs: 21EXPL: 0CVE-2021-3144
https://notcve.org/view.php?id=CVE-2021-3144
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) En SaltStack Salt versiones anteriores a 3002.5, los tokens de eauth pueden ser usados una vez después de su vencimiento. (Pueden ser usados para ejecutar un comando contra el maestro de sal o los minions) • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-c • CWE-613: Insufficient Session Expiration •
CVSS: 5.9EPSS: 1%CPEs: 21EXPL: 0CVE-2020-28972
https://notcve.org/view.php?id=CVE-2020-28972
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate. En SaltStack Salt versiones anteriores a 3002.5, una autenticación en los servidores VMware vcenter, vsphere y esxi (en los archivos vmware.py) no siempre comprueba el certificado SSL/TLS • https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25 https://security.ge • CWE-295: Improper Certificate Validation •
CVSS: 7.4EPSS: 0%CPEs: 21EXPL: 0CVE-2020-35662
https://notcve.org/view.php?id=CVE-2020-35662
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. En SaltStack Salt versiones anteriores a 3002.5, cuando se autentican en servicios usando determinados módulos, el certificado SSL no siempre es comprobado • https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25 https://security.ge • CWE-295: Improper Certificate Validation •
CVSS: 4.4EPSS: 0%CPEs: 21EXPL: 0CVE-2021-25284
https://notcve.org/view.php?id=CVE-2021-25284
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. Se detectó un problema por medio de SaltStack Salt versiones anteriores a 3002.5. salt.modules.cmdmod puede registrar credenciales para el nivel de registro de información o error • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT7 • CWE-522: Insufficiently Protected Credentials CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.8EPSS: 16%CPEs: 21EXPL: 0CVE-2021-25283
https://notcve.org/view.php?id=CVE-2021-25283
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. Se detectó un problema por medio de SaltStack Salt versiones anteriores a 3002.5. El renderizador jinja no protege contra ataques de inyección de plantilla del lado del servidor • https://github.com/saltstack/salt/releases https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5 https://saltproject.io/security_announcements/active-saltstack-c • CWE-94: Improper Control of Generation of Code ('Code Injection') •