CVE-2024-22232: Specially crafted url can be created which leads to a directory traversal in the salt file server
A specially crafted url can be created which leads to a directory traversal in the salt file server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3006.6 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 3005.5 - Upgrade
Upgrade
alpine/saltto a version that resolves this vulnerability.Fixed in 3006.6-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3005.5Fixed in 3006.6 - Upgrade
Upgrade
Saltto a version that resolves this vulnerability.Fixed in 3005.5 - Upgrade
Upgrade
Saltto a version that resolves this vulnerability.Fixed in 3006.6
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-22232?
CVE-2024-22232 is categorized as a critical vulnerability due to the potential for arbitrary file reads from the filesystem.
How do I fix CVE-2024-22232?
To mitigate CVE-2024-22232, upgrade to Salt version 3006.6 or 3005.5 as soon as possible.
What software versions are affected by CVE-2024-22232?
CVE-2024-22232 affects Salt versions between 3006.0 and 3006.6, as well as all versions up to 3005.5.
Can CVE-2024-22232 allow unauthorized access to sensitive files?
Yes, CVE-2024-22232 could enable a malicious user to read any file on the Salt master’s filesystem.
Is there a workaround for CVE-2024-22232 while awaiting a patch?
Currently, the best approach is to upgrade to the fixed versions, as no official workaround has been provided.