Arbitrary Command Injection The advisory has been revoked - it doesn't affect any version of package salt (opens in a new tab)

Threat Intelligence

5.92% (93^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-DEBIAN12-SALT-1559562
published23 Apr 2021
disclosed23 Apr 2021

Report a new vulnerability Found a mistake?

Introduced: 23 Apr 2021

CVE-2021-31607 (opens in a new tab) CWE-77 (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:12.

NVD Description

Note: Versions mentioned in the description apply only to the upstream salt package and not the salt package as distributed by Debian.

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).