PT-2021-14842 · Saltstack+1 · Saltstack Salt+1

CVE-2021-22004 · Published 2021-09-08 · Updated 2022-11-25

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 3003.3

Description An issue was discovered that allows a malicious actor to subvert the proper behavior of the minion software. This occurs when the salt minion installer accepts and uses a minion config file at C:saltconf if that file is in place before the installer is run.

Recommendations For versions prior to 3003.3, update to version 3003.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the C:saltconf directory to prevent malicious config files from being placed there.

Fix

Improper Authentication

Race Condition

Weakness Enumeration

CWE-287

CWE-362

Related Identifiers

ALT-PU-2022-3218

CVE-2021-22004

GHSA-XF37-QCVF-7M57

PYSEC-2021-346

Affected Products

Alt Linux

Saltstack Salt

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2021-22004 · Security Note
• https://ubuntu.com/security/CVE-2021-22004 · Vendor Advisory
• https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-346 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22004 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xf37-qcvf-7m57 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22004 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22004 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ · Vendor Advisory
• https://github.com/saltstack/salt · Note