CVE-2021-31607 — Command Injection in SaltStack Salt

Description

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 9	salt	2016.11.2+ds-1+deb9u7	DLA-2815-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	salt	No fix yet	—

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP3	python-distro	1.5.0-3.5.1	SUSE-SU-2021:2106-1
SLES 15 SP3	salt	3002.2-8.41.8.1	SUSE-SU-2021:1951-1
SLES 15 SP2	python-distro	1.5.0-3.5.1	SUSE-SU-2021:2106-1
SLES 15 SP2	salt	3002.2-37.1	SUSE-SU-2021:2106-1
SLES 15 SP1	salt	3002.2-37.1	SUSE-SU-2021:2105-1
SLES 15	salt	3002.2-8.41.8.1	SUSE-SU-2021:2104-1
SLES 12	salt	3000-46.142.2	SUSE-SU-2021:2102-1

Show 15 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 11 SP4	golang-github-wrouesnel-postgres_exporter	0.4.7-5.12.1	SUSE-SU-2021:14753-1
SLES 11 SP4	mgr-cfg	4.2.2-5.15.2	SUSE-SU-2021:14753-1
SLES 11 SP4	mgr-custom-info	4.2.1-5.9.2	SUSE-SU-2021:14753-1
SLES 11 SP4	mgr-daemon	4.2.7-5.26.1	SUSE-SU-2021:14753-1
SLES 11 SP4	mgr-osad	4.2.5-5.27.2	SUSE-SU-2021:14753-1
SLES 11 SP4	mgr-push	4.2.2-5.9.2	SUSE-SU-2021:14753-1
SLES 11 SP4	mgr-virtualization	4.2.1-5.17.3	SUSE-SU-2021:14753-1
SLES 11 SP4	rhnlib	4.2.3-12.31.1	SUSE-SU-2021:14753-1
SLES 11 SP4	salt	2016.11.10-43.75.1	SUSE-SU-2021:14753-1
SLES 11 SP4	spacecmd	4.2.8-18.84.1	SUSE-SU-2021:14753-1
SLES 11 SP4	spacewalk-client-tools	4.2.10-27.50.1	SUSE-SU-2021:14753-1
SLES 11 SP4	spacewalk-koan	4.2.3-9.21.1	SUSE-SU-2021:14753-1
SLES 11 SP4	spacewalk-oscap	4.2.1-6.15.3	SUSE-SU-2021:14753-1
SLES 11 SP4	spacewalk-remote-utils	4.2.1-6.18.2	SUSE-SU-2021:14753-1
SLES 11 SP4	supportutils-plugin-susemanager-client	4.2.2-9.21.1	SUSE-SU-2021:14753-1
SLES 11 SP4	suseRegisterInfo	4.2.3-6.15.1	SUSE-SU-2021:14753-1
SLES 11 SP4	uyuni-common-libs	4.2.3-5.12.1	SUSE-SU-2021:14753-1
SLES 11 SP3	golang-github-wrouesnel-postgres_exporter	0.4.7-5.12.1	SUSE-SU-2021:14753-1
SLES 11 SP3	mgr-cfg	4.2.2-5.15.2	SUSE-SU-2021:14753-1
SLES 11 SP3	mgr-custom-info	4.2.1-5.9.2	SUSE-SU-2021:14753-1
SLES 11 SP3	mgr-daemon	4.2.7-5.26.1	SUSE-SU-2021:14753-1
SLES 11 SP3	mgr-osad	4.2.5-5.27.2	SUSE-SU-2021:14753-1
SLES 11 SP3	mgr-push	4.2.2-5.9.2	SUSE-SU-2021:14753-1
SLES 11 SP3	mgr-virtualization	4.2.1-5.17.3	SUSE-SU-2021:14753-1
SLES 11 SP3	rhnlib	4.2.3-12.31.1	SUSE-SU-2021:14753-1
SLES 11 SP3	salt	2016.11.10-43.75.1	SUSE-SU-2021:14753-1
SLES 11 SP3	spacecmd	4.2.8-18.84.1	SUSE-SU-2021:14753-1
SLES 11 SP3	spacewalk-client-tools	4.2.10-27.50.1	SUSE-SU-2021:14753-1
SLES 11 SP3	spacewalk-koan	4.2.3-9.21.1	SUSE-SU-2021:14753-1
SLES 11 SP3	spacewalk-oscap	4.2.1-6.15.3	SUSE-SU-2021:14753-1
SLES 11 SP3	spacewalk-remote-utils	4.2.1-6.18.2	SUSE-SU-2021:14753-1
SLES 11 SP3	supportutils-plugin-susemanager-client	4.2.2-9.21.1	SUSE-SU-2021:14753-1
SLES 11 SP3	suseRegisterInfo	4.2.3-6.15.1	SUSE-SU-2021:14753-1
SLES 11 SP3	uyuni-common-libs	4.2.3-5.12.1	SUSE-SU-2021:14753-1
SLES 2	python-distro	1.5.0-3.5.1	SUSE-SU-2021:2106-1
SLES for SAP 15 SP1	salt	3002.2-37.1	SUSE-SU-2021:2105-1
SLES for SAP 15	salt	3002.2-8.41.8.1	SUSE-SU-2021:2104-1
SLE Micro 5.0	python-distro	1.5.0-3.5.1	SUSE-SU-2021:2106-1
SLE Micro 5.0	salt	3002.2-37.1	SUSE-SU-2021:2106-1
SLE HPC 15 SP1	salt	3002.2-37.1	SUSE-SU-2021:2105-1
SLE HPC 15	salt	3002.2-8.41.8.1	SUSE-SU-2021:2104-1
SUSE Manager Server Module 4.1	cobbler	3.0.0+git20190806.32c4bae0-5.11.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	golang-github-prometheus-node_exporter	1.1.2-3.6.5	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	grafana-formula	0.4.1-3.9.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	patterns-suse-manager	4.1-6.9.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	prometheus-exporters-formula	0.9.1-3.22.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	py26-compat-salt	2016.11.10-6.14.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	py27-compat-salt	3000.3-6.3.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-admin	4.1.9-3.12.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-backend	4.1.25-4.32.6	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-branding	4.1.12-3.12.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-certs-tools	4.1.17-3.17.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-java	4.1.36-3.44.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-utils	4.1.16-3.18.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	spacewalk-web	4.1.26-3.24.8	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager	4.1.26-3.25.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager-build-keys	15.2.4-3.17.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager-doc-indexes	4.1-11.34.8	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager-docs_en	4.1-11.34.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager-schema	4.1.21-3.30.6	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager-sls	4.1.28-3.42.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	susemanager-sync-data	4.1.14-3.23.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	tika-core	1.26-3.5.2	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1	uyuni-common-libs	4.1.8-3.9.1	SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.0	cobbler	3.0.0+git20190806.32c4bae0-7.22.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	grafana-formula	0.2.3-4.16.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	patterns-suse-manager	4.0-9.19.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	prometheus-exporters-formula	0.7.6-3.19.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	pxe-default-image-sle15	4.0.1-20210621145802	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	py26-compat-salt	2016.11.10-10.28.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	py27-compat-salt	3000.3-4.3.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	spacewalk-backend	4.0.38-3.47.4	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	spacewalk-java	4.0.44-3.57.5	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	spacewalk-utils	4.0.21-3.30.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	spacewalk-web	4.0.28-3.45.1	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	susemanager	4.0.34-3.52.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	susemanager-doc-indexes	4.0-10.36.4	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	susemanager-docs_en	4.0-10.36.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	susemanager-sls	4.0.35-3.48.3	SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0	tika-core	1.26-3.6.3	SUSE-SU-2021:2114-1
SUSE Manager Server 4.0	salt	3002.2-37.1	SUSE-SU-2021:2105-1
SUSE Manager Retail Branch Server 4.0	salt	3002.2-37.1	SUSE-SU-2021:2105-1
SUSE Manager Proxy 4.0	salt	3002.2-37.1	SUSE-SU-2021:2105-1
SUSE Manager Client Tools 12	salt	3000-46.142.2	SUSE-SU-2021:2102-1
SUSE Enterprise Storage 6	salt	3002.2-37.1	SUSE-SU-2021:2105-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.3	python-distro	1.5.0-3.5.1	openSUSE-SU-2021:2106-1
openSUSE Leap 15.3	salt	3002.2-8.41.8.1	openSUSE-SU-2021:1951-1
openSUSE Leap 15.2	salt	3002.2-lp152.3.36.1	openSUSE-SU-2021:0899-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	salt	3003-r0	—
Alpine v3.23	salt	3003-r0	—
Alpine v3.22	salt	3003-r0	—
Alpine v3.21	salt	3003-r0	—
Alpine v3.20	salt	3003-r0	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	salt	3003-r0	—
Alpine v3.18	salt	3003-r0	—
Alpine v3.17	salt	3003-r0	—
Alpine v3.16	salt	3003-r0	—
Alpine v3.15	salt	3003-r0	—
Alpine v3.14	salt	3003-r0	—
Alpine v3.13	salt	3003-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	salt	>= 2016.11.0, < 3003rc1	3003rc1	GHSA-hcjf-rp5h-g5h3

Advisories 13

DLA-2815-1 salt - security update Debian Security (DSA / DLA) · Mar 9, 2026
openSUSE-SU-2021:1951-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:2102-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:2104-1 Security update for Salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:2106-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:1951-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:14753-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:2106-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:2114-1 Security update for SUSE Manager Server 4.0 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2021:0899-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:2098-1 Security update for SUSE Manager Server 4.1 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2021:2105-1 Security update for salt SUSE / openSUSE Security Updates · May 2, 2025
WID-SEC-2023-2844 SaltStack Salt: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Nov 6, 2023

References

https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/
FEDORA-2021-5aaebdae8e vendor-advisory
FEDORA-2021-00ada7e667 vendor-advisory
FEDORA-2021-93a7c8b7c6 vendor-advisory
FEDORA-2021-158e9c6eb9 vendor-advisory
[debian-lts-announce] 20211110 [SECURITY] [DLA 2815-1] salt security update mailing-list
DSA-5011 vendor-advisory
GLSA-202310-22 vendor-advisory