CVE-2022-22967: High severity SaltStack Salt vulnerability
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3004.2 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3003.5 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3002.9 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 3002.9 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 3003.5 - Upgrade
Upgrade
SaltStack Saltto a version that resolves this vulnerability.Fixed in 3004.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-22967?
CVE-2022-22967 is an issue discovered in SaltStack Salt that allows a previously authorized user with a locked account to still run Salt commands.
Which versions of SaltStack Salt are affected by CVE-2022-22967?
Versions before 3002.9, 3003.5, and 3004.2 of SaltStack Salt are affected by CVE-2022-22967.
What is the severity of CVE-2022-22967?
CVE-2022-22967 has a severity rating of 8.8, indicating a high severity.
How does CVE-2022-22967 affect users?
CVE-2022-22967 allows users with locked accounts to still run Salt commands, bypassing the account lock.
How can CVE-2022-22967 be fixed?
To fix CVE-2022-22967, users should upgrade to SaltStack Salt versions 3002.9, 3003.5, or 3004.2 or later.