Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

SaltStack Salt Template Injection Risk: Unsecured Data Exposure

CVE-2021-25283 · published 5 years ago
Summary

A security issue in SaltStack Salt could allow attackers to inject malicious code into the system, potentially exposing sensitive data. This affects versions of SaltStack Salt prior to 3002.5. To stay safe, update to the latest version of SaltStack Salt as soon as possible.

What to do
  • Update thomas s hatch salt to version 2015.8.13.
  • Update thomas s hatch salt to version 2016.11.5.
  • Update thomas s hatch salt to version 2016.11.10.
  • Update canonical salt to version 2015.8.8+ds-1ubuntu0.1+esm2.
  • Update canonical salt to version 2017.7.4+dfsg1-1ubuntu18.04.2+esm1.
  • Update thomas s hatch salt to version 2017.7.8.
  • Update thomas s hatch salt to version 2019.2.8.
  • Update thomas s hatch salt to version 3000.7.
  • Update thomas s hatch salt to version 3001.5.
  • Update thomas s hatch salt to version 3002.5.
Affected software
Ecosystem VendorProductAffected versions
pip thomas s hatch salt < 2015.8.13
>= 2016.3.0, < 2016.11.5
>= 2016.11.7, < 2016.11.10
>= 2017.5.0, < 2017.7.8
>= 2018.2.0, <= 2018.3.5
>= 2019.2.0, < 2019.2.8
>= 3000, < 3000.7
>= 3001, < 3001.5
>= 3002, < 3002.5
Fix: upgrade to 2015.8.13
– saltstack salt < 2015.8.10
>= 2015.8.11, < 2015.8.13
>= 2016.3.0, < 2016.3.4
>= 2016.3.5, < 2016.3.6
>= 2016.3.7, < 2016.3.8
>= 2016.3.9, < 2016.11.3
>= 2016.11.4, < 2016.11.5
>= 2016.11.7, < 2016.11.10
>= 2017.5.0, < 2017.7.8
>= 2018.2.0, <= 2018.3.5
>= 2019.2.0, < 2019.2.5
>= 2019.2.6, < 2019.2.8
3 more version ranges
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*
– fedoraproject fedora 32
33
34
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
– debian debian_linux 9.0
10.0
11.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Ubuntu:Pro:14.04:LTS canonical salt All versions
Ubuntu:Pro:16.04:LTS canonical salt < 2015.8.8+ds-1ubuntu0.1+esm2
Fix: upgrade to 2015.8.8+ds-1ubuntu0.1+esm2
Ubuntu:Pro:18.04:LTS canonical salt < 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
Fix: upgrade to 2017.7.4+dfsg1-1ubuntu18.04.2+esm1
Original advisory text
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
10% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published27 Feb 2021
Updated13 Oct 2026
First seen6 Mar 2026
Sources
GHSA-xgmh-gfxw-2hvv · GHSA
CVE-2021-25283 · NVD
UBUNTU-CVE-2021-25283 · OSV
Track software like this
Free during beta