Bug 1933336 (CVE-2021-3148)

Summary:	CVE-2021-3148 salt: Command injection in salt.utils.thin.gen_thin()
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, anharris, bniver, brycel, david-dm.murphy, flucifre, frederic.pierret, gmeno, hvyas, kp, mbenjamin, mhackett, sostapov, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in salt. Command injection using the SaltAPI, is possible due to json.dumps() escaping double quotes while leaving the single quotes untouched. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-02 01:01:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1933337
Bug Blocks:	1933352

Description Pedro Sampaio 2021-02-26 18:40:58 UTC

Via the SaltAPI a command is constructed from formatted string and can be truncated if there are single quotes in extra_mods, since json.dumps() escapes double quotes while leaving the single quotes untouched.

References:

https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/

Comment 1 Pedro Sampaio 2021-02-26 18:41:25 UTC

Created salt tracking bugs for this issue:

Affects: fedora-all [bug 1933337]

Comment 2 Product Security DevOps Team 2021-03-02 01:01:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3148