GHSA-2q4g-wfm6-5fpm

SaltStack Improper Verification of Cryptographic Signature

Source: GitHub Advisory Database (reviewed) High CVE-2022-22934

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	< 3002.8	3002.8
PyPI	salt	>= 3004, < 3004.1	3004.1
PyPI	salt	>= 3003, < 3003.4	3003.4

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-22934 advisory
https://blog.cloudflare.com/future-proofing-saltstack web
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-171.yaml web
https://github.com/saltstack/salt package
https://github.com/saltstack/salt/releases web
https://github.com/saltstack/salt/releases, web
https://repo.saltproject.io web
https://saltproject.io/security_announcements/salt-security-advisory-release/, web
https://security.gentoo.org/glsa/202310-22 web