Command Injection in Salt - CVE-2021-31607

Vulnerability identifier: #VU58292

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31607

CWE-ID: CWE-77

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to command injection in the snapper module. A local user can escalate privileges on a minion.

Salt
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
SUSE Manager Debian
SUSE Linux Enterprise Server
SUSE Manager Tools
SUSE Linux Enterprise Module for Advanced Systems Management
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Transactional Server
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Basesystem
SUSE Manager Ubuntu
Fedora
salt (Debian package)
grafana-formula
golang-github-wrouesnel-postgres_exporter
prometheus-exporters-formula
golang-github-prometheus-node_exporter
python3-distro
python2-distro
tika-core
pxe-default-image-sle15
patterns-suma_server
patterns-suma_retail
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-doc-indexes
spacewalk-utils
spacewalk-base
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
susemanager-web-libs
susemanager
susemanager-tools
susemanager-sls
spacewalk-backend-config-files
spacewalk-backend-config-files-common
spacewalk-backend-config-files-tool
spacewalk-backend-iss
spacewalk-backend-iss-export
spacewalk-backend-package-push-server
spacewalk-backend-server
spacewalk-backend-sql
spacewalk-backend-sql-postgresql
spacewalk-backend-applet
spacewalk-backend-app
spacewalk-backend
python3-spacewalk-backend-libs
spacewalk-backend-tools
spacewalk-backend-xml-export-libs
spacewalk-backend-xmlrpc
spacewalk-java
spacewalk-java-config
spacewalk-java-lib
spacewalk-java-postgresql
spacewalk-taskomatic
python3-uyuni-common-libs
spacewalk-admin
spacewalk-branding
susemanager-sync-data
spacewalk-utils-extras
spacewalk-certs-tools
python3-spacewalk-certs-tools
susemanager-schema
uyuni-config-modules
mgr-custom-info
mgr-virtualization-host
python2-mgr-virtualization-common
python2-mgr-virtualization-host
spacewalk-oscap
python2-spacewalk-oscap
spacewalk-remote-utils
mgr-push
python2-mgr-push
python2-mgr-cfg
python2-mgr-cfg-actions
python2-mgr-cfg-client
python2-mgr-cfg-management
mgr-cfg-management
mgr-cfg-client
mgr-cfg-actions
mgr-cfg
supportutils-plugin-susemanager-client
python2-uyuni-common-libs
python2-suseRegisterInfo
suseRegisterInfo
python2-spacewalk-koan
spacewalk-koan
python2-rhnlib
python2-mgr-osad
python2-mgr-osa-common
mgr-osad
mgr-daemon
spacecmd
python2-spacewalk-client-setup
spacewalk-client-tools
spacewalk-client-setup
spacewalk-check
python2-spacewalk-check
python2-spacewalk-client-tools
susemanager-build-keys-web
susemanager-build-keys
py26-compat-salt
salt-minion
salt-doc
salt
py27-compat-salt
salt-bash-completion
python2-salt
python3-salt
salt-api
salt-cloud
salt-master
salt-proxy
salt-ssh
salt-standalone-formulas-configuration
salt-syndic
salt-zsh-completion
salt-fish-completion
salt-transactional-update
app-admin/salt
Dell EMC VxRail Appliance

Install updates from vendor's website.

Salt - addressed in versions 3001.8, 3002.7
salt (Debian package) - addressed in versions 2018.3.4+dfsg1-6+deb10u3, 3002.6+dfsg1-4+deb11u1
grafana-formula - addressed in versions 0.2.3-4.16.3, 0.4.1-3.9.2
golang-github-wrouesnel-postgres_exporter - update to 0.4.7-5.12.1
prometheus-exporters-formula - addressed in versions 0.7.6-3.19.3, 0.9.1-3.22.1
golang-github-prometheus-node_exporter - update to 1.1.2-3.6.5
python3-distro - update to 1.5.0-3.5.1
python2-distro - update to 1.5.0-3.5.1
tika-core - addressed in versions 1.26-3.5.2, 1.26-3.6.3
pxe-default-image-sle15 - update to 4.0.1-20210621145802
patterns-suma_server - addressed in versions 4.0-9.19.3, 4.1-6.9.2
patterns-suma_retail - addressed in versions 4.0-9.19.3, 4.1-6.9.2
susemanager-docs_en-pdf - addressed in versions 4.0-10.36.3, 4.1-11.34.2
susemanager-docs_en - addressed in versions 4.0-10.36.3, 4.1-11.34.2
susemanager-doc-indexes - addressed in versions 4.0-10.36.4, 4.1-11.34.8
spacewalk-utils - addressed in versions 4.0.21-3.30.3, 4.1.16-3.18.2
spacewalk-base - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
spacewalk-base-minimal - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
spacewalk-base-minimal-config - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
spacewalk-html - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
susemanager-web-libs - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
susemanager - addressed in versions 4.0.34-3.52.3, 4.1.26-3.25.1
susemanager-tools - addressed in versions 4.0.34-3.52.3, 4.1.26-3.25.1
susemanager-sls - addressed in versions 4.0.35-3.48.3, 4.1.28-3.42.1
spacewalk-backend-config-files - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-config-files-common - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-config-files-tool - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-iss - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-iss-export - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-package-push-server - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-server - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-sql - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-sql-postgresql - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-applet - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-app - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
python3-spacewalk-backend-libs - update to 4.0.38-3.47.4
spacewalk-backend-tools - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-xml-export-libs - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-xmlrpc - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-java - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-java-config - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-java-lib - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-java-postgresql - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-taskomatic - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
python3-uyuni-common-libs - update to 4.1.8-3.9.1
spacewalk-admin - update to 4.1.9-3.12.2
spacewalk-branding - update to 4.1.12-3.12.2
susemanager-sync-data - update to 4.1.14-3.23.2
spacewalk-utils-extras - update to 4.1.16-3.18.2
spacewalk-certs-tools - update to 4.1.17-3.17.2
python3-spacewalk-certs-tools - update to 4.1.17-3.17.2
susemanager-schema - update to 4.1.21-3.30.6
uyuni-config-modules - update to 4.1.28-3.42.1
mgr-custom-info - update to 4.2.1-5.9.2
mgr-virtualization-host - update to 4.2.1-5.17.3
python2-mgr-virtualization-common - update to 4.2.1-5.17.3
python2-mgr-virtualization-host - update to 4.2.1-5.17.3
spacewalk-oscap - update to 4.2.1-6.15.3
python2-spacewalk-oscap - update to 4.2.1-6.15.3
spacewalk-remote-utils - update to 4.2.1-6.18.2
mgr-push - update to 4.2.2-5.9.2
python2-mgr-push - update to 4.2.2-5.9.2
python2-mgr-cfg - update to 4.2.2-5.15.2
python2-mgr-cfg-actions - update to 4.2.2-5.15.2
python2-mgr-cfg-client - update to 4.2.2-5.15.2
python2-mgr-cfg-management - update to 4.2.2-5.15.2
mgr-cfg-management - update to 4.2.2-5.15.2
mgr-cfg-client - update to 4.2.2-5.15.2
mgr-cfg-actions - update to 4.2.2-5.15.2
mgr-cfg - update to 4.2.2-5.15.2
supportutils-plugin-susemanager-client - update to 4.2.2-9.21.1
python2-uyuni-common-libs - update to 4.2.3-5.12.1
python2-suseRegisterInfo - update to 4.2.3-6.15.1
suseRegisterInfo - update to 4.2.3-6.15.1
python2-spacewalk-koan - update to 4.2.3-9.21.1
spacewalk-koan - update to 4.2.3-9.21.1
python2-rhnlib - update to 4.2.3-12.31.1
python2-mgr-osad - addressed in versions 4.2.5-5.27.2, 4.2.5-8.15.1
python2-mgr-osa-common - addressed in versions 4.2.5-5.27.2, 4.2.5-8.15.1
mgr-osad - addressed in versions 4.2.5-5.27.2, 4.2.5-8.15.1
mgr-daemon - addressed in versions 4.2.7-5.26.1, 4.2.7-8.12.1
spacecmd - addressed in versions 4.2.8-2.9.1, 4.2.8-2.10.1, 4.2.8-2.15.1, 4.2.8-2.18.1, 4.2.8-2.24.1, 4.2.8-2.24.3, 4.2.8-18.84.1, 4.2.8-21.24.1, 4.2.8-26.2
python2-spacewalk-client-setup - addressed in versions 4.2.10-27.50.1, 4.2.10-30.30.1
spacewalk-client-tools - addressed in versions 4.2.10-27.50.1, 4.2.10-30.30.1
spacewalk-client-setup - addressed in versions 4.2.10-27.50.1, 4.2.10-30.30.1
spacewalk-check - addressed in versions 4.2.10-27.50.1, 4.2.10-30.30.1
python2-spacewalk-check - addressed in versions 4.2.10-27.50.1, 4.2.10-30.30.1
python2-spacewalk-client-tools - addressed in versions 4.2.10-27.50.1, 4.2.10-30.30.1
Dell EMC VxRail Appliance - update to 7.0.203
susemanager-build-keys-web - update to 15.2.4-3.17.1
susemanager-build-keys - update to 15.2.4-3.17.1
py26-compat-salt - addressed in versions 2016.11.10-6.14.2, 2016.11.10-10.28.3
salt-minion - addressed in versions 2016.11.10-43.75.1, 2016.11.10-46.18.1, 3000-46.142.2, 3000-49.35.1, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-doc - addressed in versions 2016.11.10-43.75.1, 2016.11.10-46.18.1, 3000-46.142.2, 3000-49.35.1, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt - addressed in versions 2016.11.10-43.75.1, 2016.11.10-46.18.1, 3000-46.142.2, 3000-49.35.1, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
py27-compat-salt - addressed in versions 3000.3-4.3.3, 3000.3-6.3.2
salt-bash-completion - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
python2-salt - addressed in versions 3000-46.142.2, 3000-49.35.1
python3-salt - addressed in versions 3000-46.142.2, 3000-49.35.1, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-api - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-cloud - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-master - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-proxy - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-ssh - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-standalone-formulas-configuration - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-syndic - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-zsh-completion - addressed in versions 3000-46.142.2, 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-fish-completion - addressed in versions 3002.2-8.41.1, 3002.2-8.41.8.1, 3002.2-37.1
salt-transactional-update - addressed in versions 3002.2-8.41.8.1, 3002.2-37.1
salt - addressed in versions 3003-1.fc33, 3003.3-1.fc33, 3003.3-1.fc34, 3003.3-1.fc35
app-admin/salt - update to 3004.2

• https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/
• https://bugzilla.redhat.com/show_bug.cgi?id=1953065
• https://github.com/saltstack/salt/commit/43e4ac985a2fc5f0d596c9fc6bc700b0d1af5344
• https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/

• Privilege escalation in SaltStack Salt
• Debian update for salt
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for Salt
• SUSE update for Security Beta update for Salt
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for salt
• SUSE update for SUSE Manager Server 4.1
• SUSE update for SUSE Manager Client Tools
• SUSE update for Salt
• SUSE update for Salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Server 4.0
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Gentoo update for Salt
• Fedora 33 update for salt
• Fedora 33 update for salt
• Fedora 34 update for salt
• Fedora 35 update for salt