Wiz
Vulnerability DatabaseCVE-2021-25315

CVE-2021-25315: 
Python vulnerability analysis and mitigation

Overview

CVE-2021-25315 is an Improper Authentication vulnerability (CWE-287) that affects SUSE Linux Enterprise Server 15 SP 3 and openSUSE Tumbleweed. The vulnerability allows local attackers to execute arbitrary code via salt without the need to specify valid credentials (Debian Tracker).

Technical details

The vulnerability was caused by an overlapping of upstream patch and one of SUSE's patches in the salt component. This issue affects SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3 and openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions (SUSE Bugzilla).

Impact

The vulnerability allows local attackers to execute arbitrary code without requiring valid credentials, potentially leading to unauthorized system access and code execution (NVD).

Exploitability

The vulnerability requires local access to the system to be exploited. It was confirmed that this issue was specific to SUSE implementations and did not affect the upstream salt project (SUSE Bugzilla).

Mitigation and workarounds

The issue has been fixed in salt version 3002.2-3 for SUSE Linux Enterprise Server 15 SP 3 and version 3002.2-2.1 for openSUSE Tumbleweed. Users are advised to upgrade to these versions or later (SUSE Bugzilla).

Additional resources

Source: This report was generated using AI

Related Python vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-66455CRITICAL9.8
  • Python logoPython
  • lmdeploy
NoYesSep 18, 2026
CVE-2026-63374CRITICAL9.3
  • Python logoPython
  • airflow-3
NoYesSep 18, 2026
CVE-2026-59163CRITICAL9.1
  • Python logoPython
  • mnemosyne-memory
NoYesSep 18, 2026
CVE-2026-33625HIGH8.8
  • Python logoPython
  • lmdeploy
NoYesSep 18, 2026
CVE-2026-64847MEDIUM6.8
  • Python logoPython
  • py3-anyio
NoYesSep 18, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo