Exposure of Resource to Wrong Sphere in Salt - CVE-2021-21996

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU58294

Exposure of Resource to Wrong Sphere in Salt - CVE-2021-21996

Published: November 23, 2021


Vulnerability identifier: #VU58294
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-21996
CWE-ID:
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Salt download URL. A local user with control over the file source URL and its source_hash URL can gain full file system access as root on a salt minion.


Affected software

Salt
Gentoo Linux
SUSE CaaS Platform
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
SUSE Manager Debian
SUSE Linux Enterprise Server
SUSE Manager Tools
SUSE Linux Enterprise Module for Advanced Systems Management
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Transactional Server
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Manager Ubuntu
Fedora
salt (Debian package)
scap-security-guide-ubuntu
scap-security-guide-debian
prometheus-formula
grafana-formula
python3-msgpack-python
python-msgpack-python-debugsource
python-msgpack-python-debuginfo
python-msgpack-python
python3-jabberpy
python3-immutables
python-immutables-debugsource
python3-immutables-debuginfo
prometheus-blackbox_exporter
prometheus-blackbox_exporter-debuginfo
python-MarkupSafe-debuginfo
python-MarkupSafe-debugsource
python3-MarkupSafe
python-MarkupSafe
subscription-matcher
hwdata
system-user-grafana
system-user-prometheus
zypp-plugin-spacewalk
python3-zypp-plugin-spacewalk
python3-hwdata
python3-contextvars
python3-pycrypto
python-pycrypto
python-pycrypto-debuginfo
python3-Jinja2
python-Jinja2
golang-github-prometheus-prometheus
koan
python-singledispatch
spacewalk-reports
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-doc-indexes
spacecmd
spacewalk-certs-tools
python3-spacewalk-certs-tools
spacewalk-backend
spacewalk-backend-iss-export
spacewalk-backend-app
spacewalk-backend-applet
spacewalk-backend-config-files
spacewalk-backend-config-files-common
spacewalk-backend-config-files-tool
spacewalk-backend-iss
spacewalk-backend-xmlrpc
spacewalk-backend-package-push-server
spacewalk-backend-server
spacewalk-backend-sql
spacewalk-backend-sql-postgresql
spacewalk-backend-tools
spacewalk-backend-xml-export-libs
spacewalk-base-minimal-config
susemanager-web-libs
spacewalk-base-minimal
spacewalk-html
spacewalk-base
susemanager-tools
susemanager
uyuni-config-modules
susemanager-sls
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-lib
spacewalk-java
spacewalk-java-config
py26-compat-tornado
py26-compat-tornado-debuginfo
py26-compat-tornado-debugsource
spacewalk-check
spacewalk-client-setup
spacewalk-client-tools
python2-spacewalk-client-tools
python2-spacewalk-client-setup
python2-spacewalk-check
python3-uyuni-common-libs
python3-mgr-push
mgr-push
python3-mgr-virtualization-common
mgr-virtualization-host
python3-mgr-virtualization-host
spacewalk-koan
spacewalk-oscap
python3-spacewalk-koan
spacewalk-remote-utils
python3-spacewalk-oscap
supportutils-plugin-susemanager-client
python3-suseRegisterInfo
suseRegisterInfo
python3-rhnlib
mgr-custom-info
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-cfg
python3-mgr-cfg-management
mgr-cfg-management
mgr-cfg-client
mgr-cfg-actions
mgr-cfg
mgr-daemon
mgr-osad
python3-mgr-osa-common
python3-mgr-osad
python3-spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
python-PyYAML
python-PyYAML-debuginfo
python-PyYAML-debugsource
python3-PyYAML
python-psutil
python-psutil-debuginfo
python-psutil-debugsource
python3-psutil
grafana
python-pyzmq-debugsource
python3-pyzmq
python-pyzmq-debuginfo
python-pyzmq
py26-compat-salt
salt-minion
salt-doc
salt
py27-compat-salt
salt-bash-completion
salt-zsh-completion
salt-syndic
salt-standalone-formulas-configuration
salt-ssh
salt-proxy
salt-master
salt-api
python3-salt
salt-cloud
python2-salt
salt-fish-completion
salt-transactional-update
app-admin/salt

How to mitigate CVE-2021-21996

Install updates from vendor's website.

Salt - update to 3003.3
salt (Debian package) - addressed in versions 2018.3.4+dfsg1-6+deb10u3, 3002.6+dfsg1-4+deb11u1
scap-security-guide-ubuntu - addressed in versions 0.1.57-2.9.1, 0.1.57-8.1, 0.1.58-2.6.1, 0.1.58-2.6.2
scap-security-guide-debian - addressed in versions 0.1.57-2.9.1, 0.1.58-2.6.1
prometheus-formula - update to 0.3.4-3.12.2
grafana-formula - update to 0.4.2-3.12.2
python3-msgpack-python - update to 0.4.6-11.5.1
python-msgpack-python-debugsource - update to 0.4.6-11.5.1
python-msgpack-python-debuginfo - update to 0.4.6-11.5.1
python-msgpack-python - update to 0.4.6-11.5.1
python3-jabberpy - update to 0.5-5.5.1
python3-immutables - addressed in versions 0.11-1, 0.11-3.3.1
python-immutables-debugsource - update to 0.11-3.3.1
python3-immutables-debuginfo - update to 0.11-3.3.1
prometheus-blackbox_exporter - update to 0.19.0-3.3.2
prometheus-blackbox_exporter-debuginfo - update to 0.19.0-3.3.2
python-MarkupSafe-debuginfo - update to 0.23-6.5.1
python-MarkupSafe-debugsource - update to 0.23-6.5.1
python3-MarkupSafe - update to 0.23-6.5.1
python-MarkupSafe - update to 0.23-6.5.1
subscription-matcher - update to 0.27-3.12.2
hwdata - update to 0.334-6.5.1
system-user-grafana - update to 1.0.0-3.5.1
system-user-prometheus - update to 1.0.0-3.5.1
zypp-plugin-spacewalk - update to 1.0.10-6.15.1
python3-zypp-plugin-spacewalk - update to 1.0.10-6.15.1
python3-hwdata - update to 2.3.5-5.7.1
python3-contextvars - addressed in versions 2.4-1, 2.4-3.3.1
python3-pycrypto - update to 2.6.1-13.5.1
python-pycrypto - update to 2.6.1-13.5.1
python-pycrypto-debuginfo - update to 2.6.1-13.5.1
python3-Jinja2 - update to 2.8-22.5.1
python-Jinja2 - update to 2.8-22.5.1
golang-github-prometheus-prometheus - update to 2.27.1-6.21.2
koan - update to 3.0.1-7.12.1
python-singledispatch - update to 3.4.0.3-4.8.1
spacewalk-reports - update to 4.1.4-3.6.2
susemanager-docs_en-pdf - update to 4.1-11.46.2
susemanager-docs_en - update to 4.1-11.46.2
susemanager-doc-indexes - update to 4.1-11.46.2
spacecmd - addressed in versions 4.1.15-4.30.2, 4.2.13-2.18.1, 4.2.13-2.19.1, 4.2.13-2.33.1, 4.2.13-18.93.1, 4.2.13-35.1, 4.3.4-2.18.1, 4.3.4-2.20.1, 4.3.4-2.21.2, 4.3.4-2.27.1, 4.3.4-6.27.1
spacewalk-certs-tools - update to 4.1.19-3.22.2
python3-spacewalk-certs-tools - update to 4.1.19-3.22.2
spacewalk-backend - update to 4.1.29-4.44.2
spacewalk-backend-iss-export - update to 4.1.29-4.44.2
spacewalk-backend-app - update to 4.1.29-4.44.2
spacewalk-backend-applet - update to 4.1.29-4.44.2
spacewalk-backend-config-files - update to 4.1.29-4.44.2
spacewalk-backend-config-files-common - update to 4.1.29-4.44.2
spacewalk-backend-config-files-tool - update to 4.1.29-4.44.2
spacewalk-backend-iss - update to 4.1.29-4.44.2
spacewalk-backend-xmlrpc - update to 4.1.29-4.44.2
spacewalk-backend-package-push-server - update to 4.1.29-4.44.2
spacewalk-backend-server - update to 4.1.29-4.44.2
spacewalk-backend-sql - update to 4.1.29-4.44.2
spacewalk-backend-sql-postgresql - update to 4.1.29-4.44.2
spacewalk-backend-tools - update to 4.1.29-4.44.2
spacewalk-backend-xml-export-libs - update to 4.1.29-4.44.2
spacewalk-base-minimal-config - update to 4.1.30-3.36.1
susemanager-web-libs - update to 4.1.30-3.36.1
spacewalk-base-minimal - update to 4.1.30-3.36.1
spacewalk-html - update to 4.1.30-3.36.1
spacewalk-base - update to 4.1.30-3.36.1
susemanager-tools - update to 4.1.31-3.39.2
susemanager - update to 4.1.31-3.39.2
uyuni-config-modules - update to 4.1.31-3.51.2
susemanager-sls - update to 4.1.31-3.51.2
spacewalk-taskomatic - update to 4.1.41-3.58.2
spacewalk-java-postgresql - update to 4.1.41-3.58.2
spacewalk-java-lib - update to 4.1.41-3.58.2
spacewalk-java - update to 4.1.41-3.58.2
spacewalk-java-config - update to 4.1.41-3.58.2
py26-compat-tornado - update to 4.2.1-3.3.2
py26-compat-tornado-debuginfo - update to 4.2.1-3.3.2
py26-compat-tornado-debugsource - update to 4.2.1-3.3.2
spacewalk-check - addressed in versions 4.2.14-27.59.1, 4.3.4-6.33.3
spacewalk-client-setup - addressed in versions 4.2.14-27.59.1, 4.3.4-6.33.3
spacewalk-client-tools - addressed in versions 4.2.14-27.59.1, 4.3.4-6.33.3
python2-spacewalk-client-tools - update to 4.2.14-27.59.1
python2-spacewalk-client-setup - update to 4.2.14-27.59.1
python2-spacewalk-check - update to 4.2.14-27.59.1
python3-uyuni-common-libs - update to 4.3.1-3.21.2
python3-mgr-push - update to 4.3.1-4.9.3
mgr-push - update to 4.3.1-4.9.3
python3-mgr-virtualization-common - update to 4.3.1-4.9.3
mgr-virtualization-host - update to 4.3.1-4.9.3
python3-mgr-virtualization-host - update to 4.3.1-4.9.3
spacewalk-koan - update to 4.3.1-6.9.2
spacewalk-oscap - update to 4.3.1-6.9.2
python3-spacewalk-koan - update to 4.3.1-6.9.2
spacewalk-remote-utils - update to 4.3.1-6.9.2
python3-spacewalk-oscap - update to 4.3.1-6.9.2
supportutils-plugin-susemanager-client - update to 4.3.1-6.12.2
python3-suseRegisterInfo - update to 4.3.1-6.15.2
suseRegisterInfo - update to 4.3.1-6.15.2
python3-rhnlib - update to 4.3.1-6.18.2
mgr-custom-info - update to 4.3.2-4.9.1
python3-mgr-cfg-actions - update to 4.3.2-4.15.1
python3-mgr-cfg-client - update to 4.3.2-4.15.1
python3-mgr-cfg - update to 4.3.2-4.15.1
python3-mgr-cfg-management - update to 4.3.2-4.15.1
mgr-cfg-management - update to 4.3.2-4.15.1
mgr-cfg-client - update to 4.3.2-4.15.1
mgr-cfg-actions - update to 4.3.2-4.15.1
mgr-cfg - update to 4.3.2-4.15.1
mgr-daemon - update to 4.3.2-4.15.2
mgr-osad - update to 4.3.2-4.18.2
python3-mgr-osa-common - update to 4.3.2-4.18.2
python3-mgr-osad - update to 4.3.2-4.18.2
python3-spacewalk-check - update to 4.3.4-6.33.3
python3-spacewalk-client-setup - update to 4.3.4-6.33.3
python3-spacewalk-client-tools - update to 4.3.4-6.33.3
python-PyYAML - update to 5.1.2-29.5.1
python-PyYAML-debuginfo - update to 5.1.2-29.5.1
python-PyYAML-debugsource - update to 5.1.2-29.5.1
python3-PyYAML - update to 5.1.2-29.5.1
python-psutil - update to 5.2.2-18.5.1
python-psutil-debuginfo - update to 5.2.2-18.5.1
python-psutil-debugsource - update to 5.2.2-18.5.1
python3-psutil - update to 5.2.2-18.5.1
grafana - update to 7.5.7-4.15.3
python-pyzmq-debugsource - update to 14.0.0-12.5.1
python3-pyzmq - update to 14.0.0-12.5.1
python-pyzmq-debuginfo - update to 14.0.0-12.5.1
python-pyzmq - update to 14.0.0-12.5.1
py26-compat-salt - update to 2016.11.10-17.2
salt-minion - addressed in versions 2016.11.10-43.84.1, 3000-46.151.2, 3000-49.38.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-doc - addressed in versions 2016.11.10-43.84.1, 3000-46.151.2, 3000-49.38.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt - addressed in versions 2016.11.10-43.84.1, 3000-46.151.2, 3000-49.38.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
py27-compat-salt - update to 3000.3-6.15.2
salt-bash-completion - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-zsh-completion - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-syndic - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1
salt-standalone-formulas-configuration - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-ssh - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-proxy - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-master - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-api - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1
python3-salt - addressed in versions 3000-46.151.2, 3000-49.38.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-cloud - addressed in versions 3000-46.151.2, 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
python2-salt - addressed in versions 3000-46.151.2, 3000-49.38.2
salt-fish-completion - addressed in versions 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1, 3003.3-8.44.1
salt-transactional-update - addressed in versions 3002.2-8.41.17.1, 3002.2-48.4, 3002.2-49.2, 3002.2-50.1.15.1
salt - addressed in versions 3003.3-1.fc33, 3003.3-1.fc34, 3003.3-1.fc35
app-admin/salt - update to 3004.2

External References

Related Security Bulletins