SaltStack Improper Verification of Cryptographic Signature
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-22934US | high8.8 | — | ||
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attacker… | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.cloudflare.com/future-proofing-saltstackWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-171.yamlWEB
- https://github.com/saltstack/saltPACKAGE
- https://github.com/saltstack/salt/releasesWEB
- https://github.com/saltstack/salt/releases,WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-22934ADVISORY
- https://repo.saltproject.ioWEB
- https://saltproject.io/security_announcements/salt-security-advisory-release/,WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan