{"id":"CVE-2021-21996","published":"2021-09-08T00:00:00Z","modified":"2024-08-03T18:30:23Z","title":"An issue was discovered in SaltStack Salt before 3003.3","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03514,"percentile":0.89126,"provenance":"source"},"cwes":[],"references":[{"url":"https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/","tags":["vendor-advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5011","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00017.html","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00019.html","tags":["mailing-list"]},{"url":"https://security.gentoo.org/glsa/202310-22","tags":["vendor-advisory"]}],"priority":{"score":17.8,"factors":[{"name":"EPSS percentile","points":17.83}]},"affectedVersions":[{"vendor":"n/a","product":"Saltstack Salt","versions":["Saltstack Salt (before 3003.3)"]}],"affected":[{"ecosystem":"PyPI","package":"salt","vulnerableRanges":["<3003.3"],"patched":["3003.3"],"from":["GHSA-pf7h-h2wq-m7pg","PYSEC-2021-318"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0225","exploited":false,"provenance":"source"}}