CVE-2021-22004: Fedoraproject Fedora

Medium severity, CVSS 6.4. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• SaltStack Salt: before 3000.3 (fixed in 3000.3)

Published 2021-09-08. Last modified 2026-06-17.