Skip to content
OpenAdvisories
High SUSE-RU-2022:1384-1 3 CVEs

Recommended update for Salt

Published Apr 25, 2022 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update fixes the following issues:

salt:

- Clear network interfaces cache on grains request (bsc#1196050)
- Handle old qemu-img not supporting -U parameter (bsc#1195221)
- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)
- Fix sparse disk errors on Python 2 (virt module)

Fixed packages 2

ReleasePackageFixed in
SUSE · SLES 12 Linux Enterprise Module for Advanced Systems Management 12 salt 3000-62.1
SUSE · Manager Client Tools 12 salt 3000-62.1

Vulnerabilities 3

  • High 8.8
    CVE-2022-22934

    SaltStack Improper Verification of Cryptographic Signature

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22936

    SaltStack Salt Authentication Bypass by Capture-replay

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22941

    SaltStack Salt Permissions Bypass

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…

    salt salt salt Ubuntu Alpine PyPI

References

  • report
    https://bugzilla.suse.com/1194632
  • report
    https://bugzilla.suse.com/1195221
  • report
    https://bugzilla.suse.com/1196050
  • report
    https://bugzilla.suse.com/1197417
  • web
    https://www.suse.com/security/cve/CVE-2020-22935
  • web
    https://www.suse.com/security/cve/CVE-2022-22934
  • web
    https://www.suse.com/security/cve/CVE-2022-22936
  • web
    https://www.suse.com/security/cve/CVE-2022-22941