—
PYSEC-2021-75
Quick fix
PYSEC-2021-75 — salt: upgrade to the fixed version with the command below.
pip install --upgrade 'salt>=2015.8.10'Details
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/[WEB]
- https://security.gentoo.org/glsa/202103-01[ADVISORY]
- https://github.com/advisories/GHSA-qx72-q6w3-qgc7[ADVISORY]