An issue was discovered in through SaltStack Salt before 3002.5.
Priority MEDIUM 55CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
Why it matters now
EPSS 0.10426 95th percentileScored 2026-11-07
Fix Partial salt (PyPI): 2015.8.13, 2016.11.5, 2016.11.10 +5Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2015.8.13 | 2015.8.13 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 2016.3.0 to before 2016.11.5 | 2016.11.5 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 2016.11.7 to before 2016.11.10 | 2016.11.10 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 2017.5.0 to before 2017.7.8 | 2017.7.8 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 2018.2.0 – 2018.3.5 | — | No fix listed | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 2019.2.0 to before 2019.2.8 | 2019.2.8 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 3000 to before 3000.7 | 3000.7 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 3001 to before 3001.5 | 3001.5 | Patch available | GHSA-xgmh-gfxw-2hvv |
| — | salt (PyPI) | 3002 to before 3002.5 | 3002.5 | Patch available | GHSA-xgmh-gfxw-2hvv |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2015.8.13 Fixed in 2015.8.13 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 2016.3.0 to before 2016.11.5 Fixed in 2016.11.5 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 2016.11.7 to before 2016.11.10 Fixed in 2016.11.10 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 2017.5.0 to before 2017.7.8 Fixed in 2017.7.8 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 2018.2.0 – 2018.3.5 Fixed in — No fix listed GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 2019.2.0 to before 2019.2.8 Fixed in 2019.2.8 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 3000 to before 3000.7 Fixed in 3000.7 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 3001 to before 3001.5 Fixed in 3001.5 Patch available GHSA-xgmh-gfxw-2hvv
- salt (PyPI) Vendor— Affected 3002 to before 3002.5 Fixed in 3002.5 Patch available GHSA-xgmh-gfxw-2hvv
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.3.9 to before 2016.11.3; 2016.11.4 to before 2016.11.5; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.8; 2018.2.0 – 2018.3.5; 2019.2.0 to before 2019.2.5; 2019.2.6 to before 2019.2.8; 3000 to before 3000.6; 3001 to before 3001.4; 3002 to before 3002.5 | Vulnerable | SaltStack |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.3.9 to before 2016.11.3; 2016.11.4 to before 2016.11.5; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.8; 2018.2.0 – 2018.3.5; 2019.2.0 to before 2019.2.5; 2019.2.6 to before 2019.2.8; 3000 to before 3000.6; 3001 to before 3001.4; 3002 to before 3002.5 Vulnerable ·SaltStack
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 2015.8.13 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 2016.11.5 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 2016.11.10 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 2017.7.8 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 2019.2.8 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 3000.7 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 3001.5 Advisory →
- Fix · GHSA-xgmh-gfxw-2hvv salt (PyPI) Fixed in 3002.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25283
- 2026-10-03 Alias added: GHSA-xgmh-gfxw-2hvv
References
Advisory 10
- https://github.com/saltstack/salt/releases
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- FEDORA-2021-904a2dbc0c
- FEDORA-2021-5756fbf8a6
- FEDORA-2021-43eb5584ad
- GLSA-202103-01
- [debian-lts-announce] 20211110 [SECURITY] [DLA 2815-1] salt security update
- DSA-5011
- GLSA-202310-22
- https://nvd.nist.gov/vuln/detail/CVE-2021-25283
Other 11
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.5.rst#L12
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L34
- https://github.com/saltstack/salt
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-52.yaml
Sources
- CVE-2021-25283 · CVE Program
- CVE-2021-25283 · NVD
- FIRST EPSS
- GHSA-xgmh-gfxw-2hvv · GitHub Advisory Database · CC BY 4.0
- CVE-2021-25283 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences