CVE-2021-25315
Fixed in a distro release EPSS 2%CVSS 9.8
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.
Products: SUSE Linux Enterprise Server 15 SP 3, opensuse tumbleweed
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | salt | 3002.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 6 | salt | 3002.2-37.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | salt | 3002.2-37.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | salt | 3002.2-37.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | salt | 3002.2-8.41.8.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | salt | 3002.2-8.41.8.1 |
| SUSE Linux Enterprise Micro 5.0 | python-distro | 1.5.0-3.5.1 |
| SUSE Linux Enterprise Micro 5.0 | salt | 3002.2-37.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | python-distro | 1.5.0-3.5.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | salt | 3002.2-37.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | python-distro | 1.5.0-3.5.1 |
| SUSE Linux Enterprise Module for Python 2 15 SP2 | python-distro | 1.5.0-3.5.1 |
| SUSE Linux Enterprise Module for Python 2 15 SP3 | python-distro | 1.5.0-3.5.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP2 | salt | 3002.2-37.1 |
| SUSE Linux Enterprise Module for Transactional Server 15 SP2 | salt | 3002.2-37.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | salt | 3002.2-37.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | salt | 3002.2-37.1 |
| SUSE Linux Enterprise Server 15-LTSS | salt | 3002.2-8.41.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | salt | 3002.2-8.41.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | salt | 3002.2-37.1 |
| SUSE Manager Proxy 4.0 | salt | 3002.2-37.1 |
| SUSE Manager Retail Branch Server 4.0 | salt | 3002.2-37.1 |
| SUSE Manager Server 4.0 | salt | 3002.2-37.1 |
| openSUSE Leap 15.2 | salt | 3002.2-lp152.3.36.1 |
| openSUSE Leap 15.3 | python-distro | 1.5.0-3.5.1 |