GitHub Advisoryadvisory · PyPI

GHSA-xf37-qcvf-7m57 Improper Authentication in SaltStack Salt

HIGH Published 2022-05-24 Modified 2024-10-26 Official page ↗
Aliases
CVE-2021-22004
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2022-06-23

Affected packages

• PyPI salt: < 3003.3 → fixed in 3003.3

Description

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.

Related

Alias · CVE (1)

  • CVE-2021-22004 An issue was discovered in SaltStack Salt before 3003.3. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References