Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-22934

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

Published

2022-03-29T17:15:15.170

Last Modified

2024-11-21T06:47:38.337

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

Access Vector: ADJACENT_NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

6.5

Impact Score

6.4

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	saltstack	salt	< 3002.8	Yes
Application	saltstack	salt	< 3003.4	Yes
Application	saltstack	salt	< 3004.1	Yes

References

https://github.com/saltstack/salt/releases%2C Broken Link ([email protected])
https://repo.saltproject.io/ Product ([email protected])
https://saltproject.io/security_announcements/salt-security-advisory-release/%2C Broken Link ([email protected])
https://security.gentoo.org/glsa/202310-22 Third Party Advisory ([email protected])
https://github.com/saltstack/salt/releases%2C Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://repo.saltproject.io/ Product (af854a3a-2127-422b-91ae-364da2661108)
https://saltproject.io/security_announcements/salt-security-advisory-release/%2C Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202310-22 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)