Arbitrary Data Substitution Vulnerability in SaltStack Salt by Salt Project
CVE-2022-22934

8.8HIGH

Key Information:

Vendor

Saltstack

Status
Saltstack Salt
Vendor
CVE Published:
29 March 2022

What is CVE-2022-22934?

A flaw was identified in SaltStack Salt where Salt Masters fail to sign pillar data using the minion’s public key. This oversight allows attackers to potentially substitute arbitrary pillar data, posing significant risks to the integrity of the data provided to minions. This vulnerability affects multiple versions of SaltStack Salt, emphasizing the need for immediate updates to maintain system security.

Affected Version(s)

SaltStack Salt SaltStack Salt prior to 3002.8, 3003.4, 3004.1

References

https://saltproject.io/security_announcements/salt-securi...
https://github.com/saltstack/salt/releases%2C
https://repo.saltproject.io/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.