Vulnerability Description
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Saltstack | Salt | < 2015.8.10 |
| Fedoraproject | Fedora | 32 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://github.com/saltstack/salt/releasesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-Vendor Advisory
- https://security.gentoo.org/glsa/202103-01Third Party Advisory
- https://security.gentoo.org/glsa/202310-22Third Party Advisory
- https://www.debian.org/security/2021/dsa-5011Third Party Advisory
- https://github.com/saltstack/salt/releasesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00009.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-Vendor Advisory
FAQ
What is CVE-2021-25283?
CVE-2021-25283 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
How severe is CVE-2021-25283?
CVE-2021-25283 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-25283?
Check the references section above for vendor advisories and patch information. Affected products include: Saltstack Salt, Fedoraproject Fedora, Debian Debian Linux.