4.4

CVE-2021-25284

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saltstack ≫ Salt Version < 2015.8.10
Saltstack ≫ Salt Version >= 2015.8.11 < 2015.8.13
Saltstack ≫ Salt Version >= 2016.3.0 < 2016.3.4
Saltstack ≫ Salt Version >= 2016.3.5 < 2016.3.6
Saltstack ≫ Salt Version >= 2016.3.7 < 2016.3.8
Saltstack ≫ Salt Version >= 2016.3.9 < 2016.11.3
Saltstack ≫ Salt Version >= 2016.11.4 < 2016.11.5
Saltstack ≫ Salt Version >= 2016.11.7 < 2016.11.10
Saltstack ≫ Salt Version >= 2017.5.0 < 2017.7.8
Saltstack ≫ Salt Version >= 2018.2.0 <= 2018.3.5
Saltstack ≫ Salt Version >= 2019.2.0 < 2019.2.5
Saltstack ≫ Salt Version >= 2019.2.6 < 2019.2.8
Saltstack ≫ Salt Version >= 3000 < 3000.6
Saltstack ≫ Salt Version >= 3001 < 3001.4
Saltstack ≫ Salt Version >= 3002 < 3002.5
Fedoraproject ≫ Fedora Version 32
Fedoraproject ≫ Fedora Version 33
Fedoraproject ≫ Fedora Version 34
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.426
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.4 0.8 3.6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
NIST 1.9 3.4 2.9
AV:L/AC:M/Au:N/C:N/I:P/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

https://github.com/saltstack/salt/releases
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
Third Party Advisory
Mailing List
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
Vendor Advisory
https://security.gentoo.org/glsa/202103-01
Third Party Advisory
https://security.gentoo.org/glsa/202310-22
Third Party Advisory
https://www.debian.org/security/2021/dsa-5011
Third Party Advisory