CVE-2021-25283 : faille critique saltstack salt (CVSS 9.8)

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

Sévérité

Critique (CVSS 9.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation active

Non signalée par la CISA

Publication

27 févr. 2021

Dernière mise à jour

17 juin 2026

• saltstack salt
• fedoraproject fedora
• debian debian linux

• Fiche CVE-2021-25283 sur le NVD (NIST)
• github.com/saltstack/salt/releases
• lists.debian.org/debian-lts-announce/2021/11/msg00009.html
• lists.fedoraproject.org/archives/list/package…
• lists.fedoraproject.org/archives/list/package…
• lists.fedoraproject.org/archives/list/package…
• saltproject.io/security_announcements/active…
• security.gentoo.org/glsa/202103-01
• security.gentoo.org/glsa/202310-22
• debian.org/security/2021/dsa-5011