In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade salt | Aug 22, 2024 | Apr 23, 2021 |
| Debian | — | Upgrade salt | Nov 29, 2021 | Apr 23, 2021 |
| Gentoo Linux | — | Upgrade app-admin/salt. | Nov 1, 2023 | Apr 23, 2021 |
| Suse | — | Upgrade python2-mgr-cfg-managementUpgrade mgr-custom-infoUpgrade salt-proxyUpgrade python2-suseregisterinfoUpgrade salt-minionUpgrade salt-standalone-formulas-configurationUpgrade python2-spacewalk-koanUpgrade python2-mgr-cfg-actionsUpgrade python2-spacewalk-checkUpgrade python2-mgr-osa-commonUpgrade salt-sshUpgrade salt-syndicUpgrade suseregisterinfoUpgrade python2-spacewalk-oscapUpgrade spacewalk-client-toolsUpgrade mgr-cfgUpgrade python2-saltUpgrade mgr-cfg-actionsUpgrade salt-docUpgrade python2-spacewalk-client-toolsUpgrade supportutils-plugin-susemanager-clientUpgrade spacewalk-checkUpgrade salt-transactional-updateUpgrade mgr-daemonUpgrade python2-uyuni-common-libsUpgrade mgr-cfg-clientUpgrade spacecmdUpgrade python3-distroUpgrade mgr-cfg-managementUpgrade python2-mgr-virtualization-commonUpgrade salt-fish-completionUpgrade python2-mgr-osadUpgrade salt-apiUpgrade saltUpgrade mgr-virtualization-hostUpgrade python2-spacewalk-client-setupUpgrade salt-cloudUpgrade spacewalk-oscapUpgrade python2-mgr-cfgUpgrade python2-distroUpgrade python3-saltUpgrade salt-zsh-completionUpgrade spacewalk-remote-utilsUpgrade mgr-osadUpgrade golang-github-wrouesnel-postgres_exporterUpgrade salt-masterUpgrade python2-rhnlibUpgrade salt-bash-completionUpgrade spacewalk-client-setupUpgrade mgr-pushUpgrade python2-mgr-cfg-clientUpgrade python2-mgr-virtualization-hostUpgrade spacewalk-koanUpgrade python2-mgr-push | Jun 15, 2021 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub