Credential Logging Issue in SaltStack Salt by SaltStack
CVE-2021-25284

4.4MEDIUM

Key Information:

Vendor

Saltstack

Status
Salt
Vendor
CVE Published:
27 February 2021

What is CVE-2021-25284?

A vulnerability exists in SaltStack Salt prior to version 3002.5 where the cmdmod module can inadvertently log sensitive credentials. This logging behavior can occur at both info and error log levels, potentially exposing critical operational secrets. Administrators should evaluate their logging policies and consider upgrading to the latest version to mitigate risks associated with this vulnerability.

References

https://github.com/saltstack/salt/releases
https://saltproject.io/security_announcements/active-salt...
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.