In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.
Priority MEDIUM 47CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Why it matters now
EPSS 0.05196 92nd percentileScored 2026-11-07
Fix Partial salt (PyPI): 2015.8.13, 2016.11.5, 2016.11.10 +5Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2015.8.13 | 2015.8.13 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 2016.3.0 to before 2016.11.5 | 2016.11.5 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 2016.11.7 to before 2016.11.10 | 2016.11.10 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 2017.5.0 to before 2017.7.8 | 2017.7.8 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 2018.2.0 – 2018.3.5 | — | No fix listed | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 3000 to before 3000.7 | 3000.7 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 3001 to before 3001.5 | 3001.5 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 3002 to before 3002.3 | 3002.3 | Patch available | GHSA-w2hr-3mc8-46gh |
| — | salt (PyPI) | 2019.2.0 to before 2019.2.8 | 2019.2.8 | Patch available | GHSA-w2hr-3mc8-46gh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2015.8.13 Fixed in 2015.8.13 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 2016.3.0 to before 2016.11.5 Fixed in 2016.11.5 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 2016.11.7 to before 2016.11.10 Fixed in 2016.11.10 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 2017.5.0 to before 2017.7.8 Fixed in 2017.7.8 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 2018.2.0 – 2018.3.5 Fixed in — No fix listed GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 3000 to before 3000.7 Fixed in 3000.7 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 3001 to before 3001.5 Fixed in 3001.5 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 3002 to before 3002.3 Fixed in 3002.3 Patch available GHSA-w2hr-3mc8-46gh
- salt (PyPI) Vendor— Affected 2019.2.0 to before 2019.2.8 Fixed in 2019.2.8 Patch available GHSA-w2hr-3mc8-46gh
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.3.9 to before 2016.11.3; 2016.11.4 to before 2016.11.5; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.8; 2018.2.0 – 2018.3.5; 2019.2.0 to before 2019.2.5; 2019.2.6 to before 2019.2.8; 3000 to before 3000.6; 3001 to before 3001.4; 3002 to before 3002.5 | Vulnerable | SaltStack |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.3.9 to before 2016.11.3; 2016.11.4 to before 2016.11.5; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.8; 2018.2.0 – 2018.3.5; 2019.2.0 to before 2019.2.5; 2019.2.6 to before 2019.2.8; 3000 to before 3000.6; 3001 to before 3001.4; 3002 to before 3002.5 Vulnerable ·SaltStack
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 2015.8.13 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 2016.11.5 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 2016.11.10 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 2017.7.8 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 3000.7 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 3001.5 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 3002.3 Advisory →
- Fix · GHSA-w2hr-3mc8-46gh salt (PyPI) Fixed in 2019.2.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3144
- 2026-10-03 Alias added: GHSA-w2hr-3mc8-46gh
References
Advisory 10
- https://github.com/saltstack/salt/releases
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- FEDORA-2021-904a2dbc0c
- FEDORA-2021-5756fbf8a6
- FEDORA-2021-43eb5584ad
- GLSA-202103-01
- [debian-lts-announce] 20211110 [SECURITY] [DLA 2815-1] salt security update
- DSA-5011
- GLSA-202310-22
- https://nvd.nist.gov/vuln/detail/CVE-2021-3144
Other 13
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.3.rst#L26
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L26
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.7.rst#L26
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/CHANGELOG.md?plain=1#L2373
- https://github.com/saltstack/salt
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-54.yaml
Sources
- CVE-2021-3144 · CVE Program
- CVE-2021-3144 · NVD
- FIRST EPSS
- GHSA-w2hr-3mc8-46gh · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3144 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences