CVE-2022-22934
2 advisories.
PyPI/salt CVE-2022-22934: high 8.8
SaltStack Improper Verification of Cryptographic Signature
Action: Upgrade salt to 3002.8 or later.
pip install salt==3002.8pip install salt==3004.1pip install salt==3003.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3002.8 | - |
| 3004 | 3004.1 | - |
| 3003 | 3003.4 | - |
Fixed versions
| 3002.8 | 3004.1 | 3003.4 |
Sources
- osv: GHSA-2q4g-wfm6-5fpm
- https://nvd.nist.gov/vuln/detail/CVE-2022-22934
- https://blog.cloudflare.com/future-proofing-saltstack
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-171.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/releases
- https://github.com/saltstack/salt/releases,
- https://repo.saltproject.io
- https://saltproject.io/security_announcements/salt-security-advisory-release/,
- https://security.gentoo.org/glsa/202310-22
CVE-2022-22934 · published · modified · JSON
PyPI/salt CVE-2022-22934: unknown
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbit
Action: Upgrade salt to 3002.8 or later.
pip install salt==3002.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3002.8 | - |
Fixed versions
| 3002.8 |
Sources
- osv: PYSEC-2022-171
- https://github.com/saltstack/salt/releases,
- https://repo.saltproject.io/
- https://saltproject.io/security_announcements/salt-security-advisory-release/,
- https://github.com/advisories/GHSA-2q4g-wfm6-5fpm
CVE-2022-22934 · published · modified · JSON