Description
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Saltstack Salt | Saltstack Salt (before 3003.3) | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.14 | salt | 3003.3-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | < 3003.3 | 3003.3 | GHSA-xf37-qcvf-7m57 |
References
- https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/
- FEDORA-2021-00ada7e667 vendor-advisory
- FEDORA-2021-93a7c8b7c6 vendor-advisory
- FEDORA-2021-158e9c6eb9 vendor-advisory