Skip to content
OpenAdvisories
Medium WID-SEC-2023-2843 4 CVEs

SaltStack Salt: Mehrere Schwachstellen

Published Mar 29, 2022 · Updated Nov 6, 2023 · Revision 6 · de-DE

Vendor: gentoo Vendor: SaltStack Vendor: SUSE Product: Linux Product: Linux Product: Salt Product: Salt < 3002.8 Product: Salt < 3003.4 Product: Salt < 3004.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SaltStack Salt ausnutzen, um Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen, Privilegien zu erweitern oder beliebigen Programmcode auszuführen.

Product

Salt bietet Infrastrukturverwaltung auf der Grundlage eines dynamischen Kommunikationsbusses.

Vulnerabilities 4

  • High 8.8
    CVE-2022-22934

    SaltStack Improper Verification of Cryptographic Signature

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22936

    SaltStack Salt Authentication Bypass by Capture-replay

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22941

    SaltStack Salt Permissions Bypass

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…

    salt salt salt Ubuntu Alpine PyPI
  • Low 3.7
    CVE-2022-22935

    SaltStack Salt Improper Authentication via Man in the Middle Attack

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

    salt salt salt Ubuntu Alpine PyPI

Revision history

  1. #6

    Neue Updates von Gentoo aufgenommen

  2. #5

    Neue Updates von SUSE aufgenommen

  3. #4

    Neue Updates von SUSE aufgenommen

  4. #3

    Referenz(en) aufgenommen: 2074428, 2074435, 2074433, 2074431

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References