[SECURITY] [DLA 2823-1] salt security update

2021-11-1922:50:49

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.1 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

0.005 Low

EPSS

Percentile

75.8%

JSON

Debian LTS Advisory DLA-2823-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
November 19, 2021 https://wiki.debian.org/LTS

Package : salt
Version : 2016.11.2+ds-1+deb9u8
CVE ID : CVE-2021-21996
Debian Bug : 994016

Jonathan Schlue discovered a vulnerability in Salt, a powerful remote execution
manager. A user who has control of the source, and source_hash URLs can gain
full file system access as root on a salt minion.

For Debian 9 stretch, this problem has been fixed in version
2016.11.2+ds-1+deb9u8.

We recommend that you upgrade your salt packages.

For the detailed security status of salt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/salt

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian11allsalt-minion< 3002.6+dfsg1-4+deb11u1salt-minion_3002.6+dfsg1-4+deb11u1_all.deb
Debian9allsalt-syndic< 2016.11.2+ds-1+deb9u8salt-syndic_2016.11.2+ds-1+deb9u8_all.deb
Debian9allsalt-ssh< 2016.11.2+ds-1+deb9u8salt-ssh_2016.11.2+ds-1+deb9u8_all.deb
Debian10allsalt-syndic< 2018.3.4+dfsg1-6+deb10u3salt-syndic_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian10allsalt-ssh< 2018.3.4+dfsg1-6+deb10u3salt-ssh_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian10allsalt-proxy< 2018.3.4+dfsg1-6+deb10u3salt-proxy_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian10allsalt-doc< 2018.3.4+dfsg1-6+deb10u3salt-doc_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian10allsalt-api< 2018.3.4+dfsg1-6+deb10u3salt-api_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian9allsalt-api< 2016.11.2+ds-1+deb9u8salt-api_2016.11.2+ds-1+deb9u8_all.deb
Debian9allsalt-proxy< 2016.11.2+ds-1+deb9u8salt-proxy_2016.11.2+ds-1+deb9u8_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	salt-minion	< 3002.6+dfsg1-4+deb11u1	salt-minion_3002.6+dfsg1-4+deb11u1_all.deb
Debian	9	all	salt-syndic	< 2016.11.2+ds-1+deb9u8	salt-syndic_2016.11.2+ds-1+deb9u8_all.deb
Debian	9	all	salt-ssh	< 2016.11.2+ds-1+deb9u8	salt-ssh_2016.11.2+ds-1+deb9u8_all.deb
Debian	10	all	salt-syndic	< 2018.3.4+dfsg1-6+deb10u3	salt-syndic_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	10	all	salt-ssh	< 2018.3.4+dfsg1-6+deb10u3	salt-ssh_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	10	all	salt-proxy	< 2018.3.4+dfsg1-6+deb10u3	salt-proxy_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	10	all	salt-doc	< 2018.3.4+dfsg1-6+deb10u3	salt-doc_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	10	all	salt-api	< 2018.3.4+dfsg1-6+deb10u3	salt-api_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	9	all	salt-api	< 2016.11.2+ds-1+deb9u8	salt-api_2016.11.2+ds-1+deb9u8_all.deb
Debian	9	all	salt-proxy	< 2016.11.2+ds-1+deb9u8	salt-proxy_2016.11.2+ds-1+deb9u8_all.deb