exploitDog

CVE-2021-25284

Опубликовано: 27 фев. 2021

Источник: nvd

CVSS3: 4.4

CVSS2: 1.9

EPSS Низкий

Описание

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

Ссылки

https://github.com/saltstack/salt/releases
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
Mailing List
Third Party Advisory
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
Vendor Advisory
https://security.gentoo.org/glsa/202103-01
Third Party Advisory
https://security.gentoo.org/glsa/202310-22
Third Party Advisory
https://www.debian.org/security/2021/dsa-5011
Third Party Advisory
https://github.com/saltstack/salt/releases
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
Mailing List
Third Party Advisory
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
Vendor Advisory
https://security.gentoo.org/glsa/202103-01
Third Party Advisory
https://security.gentoo.org/glsa/202310-22
Third Party Advisory
https://www.debian.org/security/2021/dsa-5011
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия до 2015.8.10 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2015.8.11 (включая) до 2015.8.13 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2016.3.0 (включая) до 2016.3.4 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2016.3.5 (включая) до 2016.3.6 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2016.3.7 (включая) до 2016.3.8 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2016.3.9 (включая) до 2016.11.3 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2016.11.4 (включая) до 2016.11.5 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2016.11.7 (включая) до 2016.11.10 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2017.5.0 (включая) до 2017.7.8 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2018.2.0 (включая) до 2018.3.5 (включая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2019.2.0 (включая) до 2019.2.5 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 2019.2.6 (включая) до 2019.2.8 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 3000 (включая) до 3000.6 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 3001 (включая) до 3001.4 (исключая)

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия от 3002 (включая) до 3002.5 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00019

Низкий

4.4 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-522

Связанные уязвимости

CVE-2021-25284

CVSS3: 4.4

ubuntu

почти 5 лет назад

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

CVE-2021-25284

CVSS3: 4.1

redhat

почти 5 лет назад

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

CVE-2021-25284

CVSS3: 4.4

debian

почти 5 лет назад

An issue was discovered in through SaltStack Salt before 3002.5. salt. ...

GHSA-r55w-xph5-xvx2

CVSS3: 4.4

github

больше 3 лет назад

SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod

openSUSE-SU-2021:0347-1

suse-cvrf

почти 5 лет назад

Security update for salt

EPSS

Процентиль: 4%

0.00019

Низкий

4.4 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-522