CVE-2021-3197
CriticalSaltStack Salt is vulnerable to shell injection via ProxyCommand argument
Published May 24, 2022 · Updated Jul 8, 2026 · Also known as GHSA-8rp6-x3r7-5qw3, PYSEC-2021-57, UBUNTU-CVE-2021-3197
Key Facts
Patch immediately- CVE-2021-3197 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Salt (Saltstack), Debian Linux, Fedora (Fedoraproject) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 72% probability of exploitation in the next 30 days.
- Fixed versions are available, including py26-compat-salt 2016.11.10-10.22.1, py26-compat-salt 2016.11.10-6.8.1, python2-salt 3000-24.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
72%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-3197 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
Affected Products
319 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SaltSaltstack | See advisory | 2015.8.10 |
| Debian LinuxDebian | 10.0, 11.0, 9.0 | n/a |
| FedoraFedoraproject | 32, 33, 34 | n/a |
| salt3-apiphoton | See advisory | 3003-1.ph4 |
| salt3-cloudphoton | See advisory | 3003-1.ph4 |
Patched Releases
py26-compat-salt
2016.11.10-10.22.1, 2016.11.10-6.8.1
python2-salt
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
python3-salt
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
release-notes-susemanager
4.0.12.1-3.68.1, 4.1.5.1-3.38.1
release-notes-susemanager-proxy
4.0.12.1-0.16.52.1, 4.1.5.1-3.26.1
Salt
2015.8.10, 2015.8.13, 2015.8.8+ds-1ubuntu0.1+esm2, 2016.11.10, 2016.11.10-43.69.1, 2016.11.2+ds-1+deb9u7, 2016.11.3, 2016.11.5, 2016.3.4, 2016.3.6, 2016.3.8, 2017.7.4+dfsg1-1ubuntu18.04.2+esm1, 2017.7.8, 2019.2.0rc1, 2019.2.4-2.ph1, 2019.2.5, 2019.2.8, 3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1, 3000.6, 3000.7, 3001.4, 3001.5, 3002.3, 3002.5, 3002.5-3, 3002.5-r0
salt-api
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-bash-completion
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-cloud
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-doc
2016.11.10-43.69.1, 3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-fish-completion
3000-24.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-master
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-minion
2016.11.10-43.69.1, 3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-proxy
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-ssh
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-standalone-formulas-configuration
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-syndic
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt-zsh-completion
3000-24.1, 3000-46.129.1, 3000-5.106.1, 3000-lp152.3.27.1
salt3
2019.2.4-2.ph1, 3002.5-1.ph3, 3003-1.ph4
salt3-api
3003-1.ph4
salt3-cloud
3003-1.ph4
salt3-master
3003-1.ph4
salt3-minion
3003-1.ph4
salt3-proxy
3003-1.ph4
salt3-spm
3003-1.ph4
Timeline
Publicly disclosed
May 24, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
References
- advisoryhttps://bugzilla.suse.com/1181550
- advisoryhttps://bugzilla.suse.com/1181556
- advisoryhttps://bugzilla.suse.com/1181557
- advisoryhttps://bugzilla.suse.com/1181558
- advisoryhttps://bugzilla.suse.com/1181559
FAQ
Common Questions.
An issue was discovered in SaltStack Salt before 3002.5.
Affected: Salt (Saltstack); Debian Linux versions 10.0, 11.0, 9.0; Fedora (Fedoraproject) versions 32, 33, 34, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including py26-compat-salt 2016.11.10-10.22.1, py26-compat-salt 2016.11.10-6.8.1, python2-salt 3000-24.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-3197 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo