CVE-2021-31607: Command Injection
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-31607?
CVE-2021-31607 is a command injection vulnerability in the snapper module of SaltStack Salt 2016.9 through 3002.6, allowing for local privilege escalation on a minion.
What is the severity of CVE-2021-31607?
The severity of CVE-2021-31607 is high with a CVSS score of 7.8.
How does CVE-2021-31607 work?
CVE-2021-31607 requires the creation of a file with a backed-up pathname by snapper and the master calling the snapper.diff function, leading to command injection and potential privilege escalation.
Which versions of SaltStack Salt are affected by CVE-2021-31607?
SaltStack Salt versions 2016.9 through 3002.6 are affected by CVE-2021-31607.
How can I fix CVE-2021-31607?
To fix CVE-2021-31607, update to SaltStack Salt version 2018.3.4+dfsg1-6+deb10u3 or 3002.6+dfsg1-4+deb11u1 or 3004.1+dfsg-2.2, as recommended by Debian.