CVE-2022-22936
2 advisories.
PyPI/salt CVE-2022-22936: high 8.8, EPSS 0.83%
SaltStack Salt Authentication Bypass by Capture-replay
Action: Upgrade salt to 3002.8 or later.
pip install salt==3002.8pip install salt==3003.4pip install salt==3004.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3002.8 | - |
| 3003 | 3003.4 | - |
| 3004 | 3004.1 | - |
Fixed versions
| 3002.8 | 3003.4 | 3004.1 |
Sources
- osv: GHSA-5r3f-3m3j-wcj2
- https://nvd.nist.gov/vuln/detail/CVE-2022-22936
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-173.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L32
- https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L30
- https://github.com/saltstack/salt/releases
- https://repo.saltproject.io
- https://saltproject.io/security_announcements/salt-security-advisory-release
- https://security.gentoo.org/glsa/202310-22
CVE-2022-22936 · published · modified · JSON
PyPI/salt CVE-2022-22936: unknown, EPSS 0.83%
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying
Action: Upgrade salt to 3002.8 or later.
pip install salt==3002.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3002.8 | - |
Fixed versions
| 3002.8 |
Sources
- osv: PYSEC-2022-173
- https://github.com/saltstack/salt/releases,
- https://repo.saltproject.io/
- https://saltproject.io/security_announcements/salt-security-advisory-release/,
- https://github.com/advisories/GHSA-5r3f-3m3j-wcj2
CVE-2022-22936 · published · modified · JSON