GitHub Advisoryadvisory · PyPI

GHSA-2q4g-wfm6-5fpm SaltStack Improper Verification of Cryptographic Signature

HIGH Published 2022-03-30 Modified 2024-10-26 Official page ↗
Aliases
CVE-2022-22934
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Reviewed
2023-08-09

Affected packages

• PyPI salt: < 3002.8 → fixed in 3002.8 • PyPI salt: >= 3004, < 3004.1 → fixed in 3004.1 • PyPI salt: >= 3003, < 3003.4 → fixed in 3003.4

Description

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

Related

Alias · CVE (1)

  • CVE-2022-22934 An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References