CVE-2022-22934
published 2022-03-29CVE-2022-22934: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which…
PriorityP348high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.86%
54.0th percentile
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| saltstack | salt | >= 0 < 3002.8 | 3002.8 |
| saltstack | salt | >= 3002 < 3002.8 | 3002.8 |
| saltstack | salt | >= 3003 < 3003.4 | 3003.4 |
| saltstack | salt | >= 3003 < 3003.4 | 3003.4 |
| saltstack | salt | >= 3004 < 3004.1 | 3004.1 |
| saltstack | salt | >= 3004 < 3004.1 | 3004.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SaltStack Improper Verification of Cryptographic Signature
ghsa·2022-03-30
CVE-2022-22934 [HIGH] CWE-347 SaltStack Improper Verification of Cryptographic Signature
SaltStack Improper Verification of Cryptographic Signature
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
OSV
SaltStack Improper Verification of Cryptographic Signature
osv·2022-03-30
CVE-2022-22934 [HIGH] SaltStack Improper Verification of Cryptographic Signature
SaltStack Improper Verification of Cryptographic Signature
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
OSV
CVE-2022-22934: An issue was discovered in SaltStack Salt in versions before 3002
osv·2022-03-29
CVE-2022-22934 CVE-2022-22934: An issue was discovered in SaltStack Salt in versions before 3002
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/saltstack/salt/releases%2Chttps://repo.saltproject.io/https://saltproject.io/security_announcements/salt-security-advisory-release/%2Chttps://security.gentoo.org/glsa/202310-22https://github.com/saltstack/salt/releases%2Chttps://repo.saltproject.io/https://saltproject.io/security_announcements/salt-security-advisory-release/%2Chttps://security.gentoo.org/glsa/202310-22
2022-03-29
Published