[SECURITY] [DLA 2823-2] salt regression update

2021-11-2100:41:02

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.1 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

0.005 Low

EPSS

Percentile

75.8%

JSON

Debian LTS Advisory DLA-2823-2 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
November 21, 2021 https://wiki.debian.org/LTS

Package : salt
Version : 2016.11.2+ds-1+deb9u9
CVE ID : CVE-2021-21996
Debian Bug : 1000265

The security update of Salt, a remote execution manager, to fix CVE-2021-21996
introduced a regression in salt/fileclient.py which raised an unexpected
exception and made file.managed states fail.

For Debian 9 stretch, this problem has been fixed in version
2016.11.2+ds-1+deb9u9.

We recommend that you upgrade your salt packages.

For the detailed security status of salt please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/salt

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian9allsalt-ssh< 2016.11.2+ds-1+deb9u8salt-ssh_2016.11.2+ds-1+deb9u8_all.deb
Debian11allsalt-minion< 3002.6+dfsg1-4+deb11u1salt-minion_3002.6+dfsg1-4+deb11u1_all.deb
Debian10allsalt-common< 2018.3.4+dfsg1-6+deb10u3salt-common_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian9allsalt-doc< 2016.11.2+ds-1+deb9u8salt-doc_2016.11.2+ds-1+deb9u8_all.deb
Debian9allsalt-cloud< 2016.11.2+ds-1+deb9u9salt-cloud_2016.11.2+ds-1+deb9u9_all.deb
Debian10allsalt-master< 2018.3.4+dfsg1-6+deb10u3salt-master_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian10allsalt-minion< 2018.3.4+dfsg1-6+deb10u3salt-minion_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian9allsalt-api< 2016.11.2+ds-1+deb9u8salt-api_2016.11.2+ds-1+deb9u8_all.deb
Debian11allsalt-doc< 3002.6+dfsg1-4+deb11u1salt-doc_3002.6+dfsg1-4+deb11u1_all.deb
Debian10allsalt-proxy< 2018.3.4+dfsg1-6+deb10u3salt-proxy_2018.3.4+dfsg1-6+deb10u3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	salt-ssh	< 2016.11.2+ds-1+deb9u8	salt-ssh_2016.11.2+ds-1+deb9u8_all.deb
Debian	11	all	salt-minion	< 3002.6+dfsg1-4+deb11u1	salt-minion_3002.6+dfsg1-4+deb11u1_all.deb
Debian	10	all	salt-common	< 2018.3.4+dfsg1-6+deb10u3	salt-common_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	9	all	salt-doc	< 2016.11.2+ds-1+deb9u8	salt-doc_2016.11.2+ds-1+deb9u8_all.deb
Debian	9	all	salt-cloud	< 2016.11.2+ds-1+deb9u9	salt-cloud_2016.11.2+ds-1+deb9u9_all.deb
Debian	10	all	salt-master	< 2018.3.4+dfsg1-6+deb10u3	salt-master_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	10	all	salt-minion	< 2018.3.4+dfsg1-6+deb10u3	salt-minion_2018.3.4+dfsg1-6+deb10u3_all.deb
Debian	9	all	salt-api	< 2016.11.2+ds-1+deb9u8	salt-api_2016.11.2+ds-1+deb9u8_all.deb
Debian	11	all	salt-doc	< 3002.6+dfsg1-4+deb11u1	salt-doc_3002.6+dfsg1-4+deb11u1_all.deb
Debian	10	all	salt-proxy	< 2018.3.4+dfsg1-6+deb10u3	salt-proxy_2018.3.4+dfsg1-6+deb10u3_all.deb