CVE-2021-3197: salt: Shell injection by including ProxyCommand in an argument

Severity: Critical

CVSS Score: 9.8

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.