An issue was discovered in through SaltStack Salt before 3002.5.
Priority LOW 21CWE-522Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.
Summary
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
Why it matters now
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Partial salt (PyPI): 2015.8.13, 2016.11.5, 2016.11.10 +5Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2015.8.13 | 2015.8.13 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 2016.3.0 to before 2016.11.5 | 2016.11.5 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 2016.11.7 to before 2016.11.10 | 2016.11.10 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 2017.5.0 to before 2017.7.8 | 2017.7.8 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 2018.2.0 – 2018.3.5 | — | No fix listed | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 2019.2.0 to before 2019.2.8 | 2019.2.8 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 3000 to before 3000.7 | 3000.7 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 3001 to before 3001.5 | 3001.5 | Patch available | GHSA-r55w-xph5-xvx2 |
| — | salt (PyPI) | 3002 to before 3002.3 | 3002.3 | Patch available | GHSA-r55w-xph5-xvx2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2015.8.13 Fixed in 2015.8.13 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 2016.3.0 to before 2016.11.5 Fixed in 2016.11.5 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 2016.11.7 to before 2016.11.10 Fixed in 2016.11.10 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 2017.5.0 to before 2017.7.8 Fixed in 2017.7.8 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 2018.2.0 – 2018.3.5 Fixed in — No fix listed GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 2019.2.0 to before 2019.2.8 Fixed in 2019.2.8 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 3000 to before 3000.7 Fixed in 3000.7 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 3001 to before 3001.5 Fixed in 3001.5 Patch available GHSA-r55w-xph5-xvx2
- salt (PyPI) Vendor— Affected 3002 to before 3002.3 Fixed in 3002.3 Patch available GHSA-r55w-xph5-xvx2
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.3.9 to before 2016.11.3; 2016.11.4 to before 2016.11.5; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.8; 2018.2.0 – 2018.3.5; 2019.2.0 to before 2019.2.5; 2019.2.6 to before 2019.2.8; 3000 to before 3000.6; 3001 to before 3001.4; 3002 to before 3002.5 | Vulnerable | SaltStack |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2015.8.10; 2015.8.11 to before 2015.8.13; 2016.3.0 to before 2016.3.4; 2016.3.5 to before 2016.3.6; 2016.3.7 to before 2016.3.8; 2016.3.9 to before 2016.11.3; 2016.11.4 to before 2016.11.5; 2016.11.7 to before 2016.11.10; 2017.5.0 to before 2017.7.8; 2018.2.0 – 2018.3.5; 2019.2.0 to before 2019.2.5; 2019.2.6 to before 2019.2.8; 3000 to before 3000.6; 3001 to before 3001.4; 3002 to before 3002.5 Vulnerable ·SaltStack
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 2015.8.13 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 2016.11.5 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 2016.11.10 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 2017.7.8 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 2019.2.8 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 3000.7 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 3001.5 Advisory →
- Fix · GHSA-r55w-xph5-xvx2 salt (PyPI) Fixed in 3002.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25284
- 2026-10-03 Alias added: GHSA-r55w-xph5-xvx2
References
Advisory 11
- https://github.com/saltstack/salt/releases
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
- FEDORA-2021-904a2dbc0c
- FEDORA-2021-5756fbf8a6
- FEDORA-2021-43eb5584ad
- GLSA-202103-01
- [debian-lts-announce] 20211110 [SECURITY] [DLA 2815-1] salt security update
- DSA-5011
- [debian-lts-announce] 20220103 [SECURITY] [DLA 2480-2] salt regression update
- GLSA-202310-22
- https://nvd.nist.gov/vuln/detail/CVE-2021-25284
Other 12
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.3.rst#L37
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L37
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.7.rst#L37
- https://github.com/saltstack/salt
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-53.yaml
Sources
- CVE-2021-25284 · CVE Program
- CVE-2021-25284 · NVD
- FIRST EPSS
- GHSA-r55w-xph5-xvx2 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-25284 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences