Authentication Flaw in Salt Project's PKI Module Affects Multiple Versions

CVE-2024-38825

What is CVE-2024-38825?

The salt.auth.pki module contains an authentication flaw that allows unauthorized access. In this module, the 'password' field is expected to contain a public certificate, which is incorrectly validated against a Certificate Authority (CA) certificate. Consequently, the authentication process does not require the caller to possess the corresponding private key, thereby circumventing proper PKI authentication measures. This vulnerability could potentially allow malicious actors to bypass security protocols and execute unauthorized actions within the affected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References