Skip to content
OpenAdvisories
High SUSE-RU-2022:1389-1 4 CVEs

Recommended update for salt

Published Apr 25, 2022 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update for salt fixes the following issues:

- Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions processed at the same time (bsc#1197637)
- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)
- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)

Fixed packages 6

ReleasePackageFixed in
SUSE · Enterprise Storage 6 salt 3002.2-150100.63.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-ESPOS salt 3002.2-150100.63.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-LTSS salt 3002.2-150100.63.1
SUSE · SLES 15 SP1 Linux Enterprise Server 15 SP1-BCL salt 3002.2-150100.63.1
SUSE · SLES 15 SP1 Linux Enterprise Server 15 SP1-LTSS salt 3002.2-150100.63.1
SUSE · SLES for SAP 15 SP1 Linux Enterprise Server for SAP Applications 15 SP1 salt 3002.2-150100.63.1

Vulnerabilities 4

  • High 8.8
    CVE-2022-22934

    SaltStack Improper Verification of Cryptographic Signature

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22936

    SaltStack Salt Authentication Bypass by Capture-replay

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22941

    SaltStack Salt Permissions Bypass

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…

    salt salt salt Ubuntu Alpine PyPI
  • Low 3.7
    CVE-2022-22935

    SaltStack Salt Improper Authentication via Man in the Middle Attack

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

    salt salt salt Ubuntu Alpine PyPI

References

  • report
    https://bugzilla.suse.com/1182851
  • report
    https://bugzilla.suse.com/1194632
  • report
    https://bugzilla.suse.com/1196050
  • report
    https://bugzilla.suse.com/1196432
  • report
    https://bugzilla.suse.com/1197417
  • report
    https://bugzilla.suse.com/1197533
  • report
    https://bugzilla.suse.com/1197637
  • web
    https://www.suse.com/security/cve/CVE-2022-22934
  • web
    https://www.suse.com/security/cve/CVE-2022-22935
  • web
    https://www.suse.com/security/cve/CVE-2022-22936
  • web
    https://www.suse.com/security/cve/CVE-2022-22941