CVE-2021-21996 — Exposure of Resource to Wrong Sphere in salt

Description

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

Affected products

Vendor	Product	Affected	Fixed
—	Saltstack Salt	Saltstack Salt (before 3003.3)	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 11	salt	3002.6+dfsg1-4+deb11u1	DSA-5011-1
Debian 10	salt	2018.3.4+dfsg1-6+deb10u3	DSA-5011-1
Debian 9	salt	2016.11.2+ds-1+deb9u8	DLA-2823-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	salt	No fix yet	—

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP3	salt	3002.2-50.1.15.1	SUSE-SU-2021:3557-1
SLES 15 SP2	salt	3002.2-49.2	SUSE-SU-2021:3556-1
SLES 15 SP1	salt	3002.2-48.4	SUSE-SU-2021:3555-1
SLES 15	salt	3002.2-8.41.17.1	SUSE-SU-2021:3553-1
SLES 12	salt	3000-46.151.2	SUSE-SU-2021:3550-1

Show 15 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 11 SP4	salt	2016.11.10-43.84.1	SUSE-SU-2021:14833-1
SLES 11 SP4	spacecmd	4.2.13-18.93.1	SUSE-SU-2021:14833-1
SLES 11 SP4	spacewalk-client-tools	4.2.14-27.59.1	SUSE-SU-2021:14833-1
SLES 11 SP3	salt	2016.11.10-43.84.1	SUSE-SU-2021:14833-1
SLES 11 SP3	spacecmd	4.2.13-18.93.1	SUSE-SU-2021:14833-1
SLES 11 SP3	spacewalk-client-tools	4.2.14-27.59.1	SUSE-SU-2021:14833-1
SLES for SAP 15 SP1	salt	3002.2-48.4	SUSE-SU-2021:3555-1
SLES for SAP 15	salt	3002.2-8.41.17.1	SUSE-SU-2021:3553-1
SLE Micro 5.1	salt	3002.2-50.1.15.1	SUSE-SU-2021:3557-1
SLE Micro 5.0	salt	3002.2-49.2	SUSE-SU-2021:3556-1
SLE HPC 15 SP1	salt	3002.2-48.4	SUSE-SU-2021:3555-1
SLE HPC 15	salt	3002.2-8.41.17.1	SUSE-SU-2021:3553-1
SUSE Manager Server Module 4.2	cobbler	3.1.2-5.11.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	hub-xmlrpc-api	0.7-3.3.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	inter-server-sync	0.0.5-8.6.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	patterns-suse-manager	4.2-4.3.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	py26-compat-salt	2016.11.10-11.28.9.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	py26-compat-tornado	4.2.1-3.3.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	py27-compat-salt	3000.3-7.7.11.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacecmd	4.2.13-4.9.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-admin	4.2.9-3.6.2	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-backend	4.2.17-4.9.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-certs-tools	4.2.13-3.9.2	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-client-tools	4.2.14-4.9.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-java	4.2.30-3.14.4	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-utils	4.2.14-3.9.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	spacewalk-web	4.2.23-3.9.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	subscription-matcher	0.27-6.3.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	supportutils-plugin-susemanager	4.2.3-3.3.2	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	susemanager	4.2.25-3.13.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	susemanager-doc-indexes	4.2-12.11.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	susemanager-docs_en	4.2-12.11.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	susemanager-schema	4.2.18-3.9.3	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	susemanager-sls	4.2.18-3.11.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	susemanager-sync-data	4.2.9-3.9.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.2	virtualization-formulas	0.6.1-8.3.1	SUSE-SU-2021:3561-1
SUSE Manager Server Module 4.1	grafana-formula	0.4.2-3.12.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	prometheus-formula	0.3.4-3.12.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	py26-compat-salt	2016.11.10-17.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	py26-compat-tornado	4.2.1-3.3.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	py27-compat-salt	3000.3-6.15.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	spacecmd	4.1.15-4.30.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	spacewalk-backend	4.1.29-4.44.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	spacewalk-certs-tools	4.1.19-3.22.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	spacewalk-java	4.1.41-3.58.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	spacewalk-reports	4.1.4-3.6.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	spacewalk-web	4.1.30-3.36.1	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	subscription-matcher	0.27-3.12.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	susemanager	4.1.31-3.39.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	susemanager-docs_en +1	4.1-11.46.2	SUSE-SU-2021:3621-1
SUSE Manager Server Module 4.1	susemanager-sls	4.1.31-3.51.2	SUSE-SU-2021:3621-1
SUSE Manager Server 4.2	release-notes-susemanager	4.2.3-3.19.1	SUSE-RU-2021:3551-1
SUSE Manager Retail Branch Server 4.2	release-notes-susemanager-proxy	4.2.3-3.15.1	SUSE-RU-2021:3551-1
SUSE Manager Proxy 4.2	release-notes-susemanager-proxy	4.2.3-3.15.1	SUSE-RU-2021:3551-1
SUSE Manager Client Tools 12	salt	3000-46.151.2	SUSE-SU-2021:3550-1
SUSE Enterprise Storage 6	salt	3002.2-48.4	SUSE-SU-2021:3555-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.3	salt	3002.2-50.1.15.1	openSUSE-SU-2021:3557-1
openSUSE Leap 15.2	salt	3002.2-lp152.3.45.1	openSUSE-SU-2021:1443-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.14	salt	3003.3-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	salt	< 3003.3	3003.3	GHSA-pf7h-h2wq-m7pg

Advisories 13

DSA-5011-1 salt - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2823-1 salt - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2021:3557-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3553-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3561-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2021:3551-1 Recommended update for SUSE Manager 4.2.3 Release Notes SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3550-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:1443-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:3557-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:14833-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3555-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3556-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:3621-1 Security update for SUSE Manager Server 4.1 SUSE / openSUSE Security Updates · May 2, 2025

References

https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/
FEDORA-2021-00ada7e667 vendor-advisory
FEDORA-2021-93a7c8b7c6 vendor-advisory
FEDORA-2021-158e9c6eb9 vendor-advisory
DSA-5011 vendor-advisory
[debian-lts-announce] 20211119 [SECURITY] [DLA 2823-1] salt security update mailing-list
[debian-lts-announce] 20211121 [SECURITY] [DLA 2823-2] salt regression update mailing-list
GLSA-202310-22 vendor-advisory