CVE-2021-25315: Saltstack Salt Unauthenticated Arbitrary Code Execution

May 24, 2022 (updated April 9, 2025)

A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

References

bugzilla.suse.com/show_bug.cgi?id=1182382
github.com/advisories/GHSA-pmj6-9f8c-8g2m
github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-891.yaml
github.com/saltstack/salt
nvd.nist.gov/vuln/detail/CVE-2021-25315

Code Behaviors & Features

Detect and mitigate CVE-2021-25315 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →