Patchfirst
Patchfirst
CVE-2021-25282 Public exploit EPSS 92.4%

An issue was discovered in through SaltStack Salt before 3002.5

Summary

The flaw is a directory traversal vulnerability in the salt.wheel.pillar_roots.write method of SaltStack Salt, affecting releases before 3002.5.

Official description · CVE.org

An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

Breakdown
25.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 2 days before disclosure.

  1. Public exploit codeMetasploit2 days before
  2. Disclosedday 0

8 fixes in salt over 6 months. The latest fix listed for salt is 3003rc1.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3002.1CVE-2020-255926 Nov 2020
  2. 3002.3CVE-2021-314427 Feb 2021
  3. 3002.3CVE-2021-314827 Feb 2021
  4. 3002.5CVE-2021-2528127 Feb 2021
  5. 3002.5CVE-2021-2528227 Feb 2021
  6. 3002.5CVE-2021-2528327 Feb 2021
  7. 3002.5CVE-2021-319727 Feb 2021
  8. 3003rc1CVE-2021-3160723 Apr 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: salt.

PyPIsaltGHSA-76x4-x3p6-rpr9PYSEC-2021-51

Upgrade to 3002.5 or later

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-16846, CVE-2020-25592, +2).

pippip install "salt>=3002.5"

The first fix for CVE-2021-25282.

Affected versions, by release line

If you runUpgrade to
3002 up to 3002.53002.5
3002 up to 3002.3

Still affected on this line by CVE-2021-25281 (fixed in 3002.5, a newer line); CVE-2021-3197 (fixed in 3002.5, a newer line).

3002.3
3001 up to 3001.53001.5
3001 up to 3001.4

Still affected on this line by CVE-2021-25281 (fixed in 3001.5, a newer line); CVE-2021-3197 (fixed in 3001.5, a newer line).

3001.4
3000 up to 3000.73000.7
3000 up to 3000.6

Still affected on this line by CVE-2021-25281 (fixed in 3000.7, a newer line); CVE-2021-3197 (fixed in 3000.7, a newer line).

3000.6
2019.2.6 up to 2019.2.82019.2.8
2019.2.0 up to 2019.2.82019.2.8
2019.2.0 up to 2019.2.5

Still affected on this line by CVE-2020-16846 (fixed in 2019.2.6, a newer line); CVE-2020-25592 (fixed in 2019.2.7, a newer line); CVE-2021-25281 (fixed in 2019.2.8, a newer line); CVE-2021-3197 (fixed in 2019.2.8, a newer line).

2019.2.5
2018.3.0rc1 up to 2019.2.0rc1

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2019.2.0rc1
2018.2.0 through 2018.3.5No fix published
2017.7.0 up to 2017.7.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2017.7.8
2017.5.0 up to 2017.7.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2017.7.8
2016.11.7 up to 2016.11.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2016.11.10
2016.11.4 up to 2016.11.5

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.10, a newer line); CVE-2020-25592 (fixed in 2016.11.10, a newer line).

2016.11.6first fix for this CVE: 2016.11.5
2016.11.0 up to 2016.11.3

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.10, a newer line); CVE-2020-25592 (fixed in 2016.11.10, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.11.3
2016.3.7 up to 2016.3.8

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.8
2016.3.5 up to 2016.3.6

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.3.8, a newer line); CVE-2020-25592 (fixed in 2016.3.8, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.6
2016.3.0 up to 2016.11.5

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.11.6, a newer line); CVE-2020-25592 (fixed in 2016.11.6, a newer line).

2016.11.5
2016.3.0 up to 2016.3.4

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-16846 (fixed in 2016.3.8, a newer line); CVE-2020-25592 (fixed in 2016.3.8, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).

2016.3.4
All versions before 2015.8.13

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2015.8.13
All versions before 2015.8.10

Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).

2015.8.13first fix for this CVE: 2015.8.10

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

11 links, grouped by NVD tag

Other 3

github.com/saltstack/salt/releasessaltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html

vendor-advisory 6

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/security.gentoo.org/glsa/202103-01debian.org/security/2021/dsa-5011security.gentoo.org/glsa/202310-22

mailing-list 2

lists.debian.org/debian-lts-announce/2021/11/msg00009.htmllists.debian.org/debian-lts-announce/2022/01/msg00000.html
↑ ↓ chooseEnter openEsc close