GHSA-ghc2-hx3w-jqmpCriticalCVSS 9.8

SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

Published
May 24, 2022
Last Modified
October 23, 2024

🔗 CVE IDs covered (1)

CVE-2021-3148 →

📋 Description

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.

🎯 Affected products9

  • pip/salt:< 2015.8.13
  • pip/salt:>= 2016.3.0, < 2016.11.5
  • pip/salt:>= 2016.11.7, < 2016.11.10
  • pip/salt:>= 2017.5.0, < 2017.7.8
  • pip/salt:>= 2018.2.0, <= 2018.3.5
  • pip/salt:>= 2019.2.0, < 2019.2.8
  • pip/salt:>= 3000, < 3000.7
  • pip/salt:>= 3001, < 3001.5
  • pip/salt:>= 3002, < 3002.3

🔗 References (19)