{"action":"Upgrade salt to 3002.9 or later.","affected":[{"fixed":"3002.9","introduced":"0"}],"component":"salt","cve_ids":["CVE-2022-22967"],"ecosystem":"PyPI","epss":0.02062,"exploited":false,"fixed_versions":["3002.9"],"ghsa_id":"GHSA-fpxm-fprw-6hxj","id":"tcs_01M5KGGHSFA54HEX7E8E86HDPC","modified_at":"2023-11-08T04:08:15.057201Z","published_at":"2022-06-23T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-210","https://repo.saltproject.io/","https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/,","https://github.com/advisories/GHSA-fpxm-fprw-6hxj"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-210","url":"https://osv.dev/vulnerability/PYSEC-2022-210"}],"summary":"An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still r"}