GitStock

saltstack/salt · Security

SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

GHSA ID
GHSA-ghc2-hx3w-jqmp
CVE ID
CVE-2021-3148
Severity
critical
Published
Updated
CVSS
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.

CWEs

  • CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')

References

Open GitHub