GitStock

saltstack/salt · Security

SaltStack Salt eauth tokens can be used once after expiration

GHSA ID
GHSA-w2hr-3mc8-46gh
CVE ID
CVE-2021-3144
Severity
critical
Published
Updated
CVSS
9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v3
9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

CWEs

  • CWE-613 · Insufficient Session Expiration

References

Open GitHub