[Pkg-salt-team] Bug#987496: salt: CVE-2021-31607

[Salvatore Bonaccorso]

Source: salt
Version: 3002.6+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 2018.3.4+dfsg1-6+deb10u2
Control: found -1 2018.3.4+dfsg1-6

Hi,

The following vulnerability was published for salt.

CVE-2021-31607[0]:
| In SaltStack Salt 2016.9 through 3002.6, a command injection
| vulnerability exists in the snapper module that allows for local
| privilege escalation on a minion. The attack requires that a file is
| created with a pathname that is backed up by snapper, and that the
| master calls the snapper.diff function (which executes popen
| unsafely).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-31607
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31607
[1] https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/

Please adjust the affected versions in the BTS as needed, but
according to the reporte rall versions between 2016.9 through 3002.6
are affected.

Regards,
Salvatore