CVE-2021-31607

Katalog CVE

CVSS 7.8 · High EPSS 5,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada saltstack salt, fedoraproject fedora. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).

Rincian

Terbit di NVD

23 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

5,9% peluang dieksploitasi; lebih tinggi dari 93,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/ exploit · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLW... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDKMAJXYFHM4U... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRC... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-22 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5011 advisory pihak ketiga