CVE-2022-22967: High severity saltstack vulnerability
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-22967?
CVE-2022-22967 is an issue discovered in SaltStack Salt that allows a previously authorized user with a locked account to still run Salt commands.
Which versions of SaltStack Salt are affected by CVE-2022-22967?
Versions before 3002.9, 3003.5, and 3004.2 of SaltStack Salt are affected by CVE-2022-22967.
What is the severity of CVE-2022-22967?
CVE-2022-22967 has a severity rating of 8.8, indicating a high severity.
How does CVE-2022-22967 affect users?
CVE-2022-22967 allows users with locked accounts to still run Salt commands, bypassing the account lock.
How can CVE-2022-22967 be fixed?
To fix CVE-2022-22967, users should upgrade to SaltStack Salt versions 3002.9, 3003.5, or 3004.2 or later.