GHSA-fpxm-fprw-6hxj

Salt's PAM auth fails to reject locked accounts

Source: GitHub Advisory Database (reviewed) High CVE-2022-22967

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	< 3002.9	3002.9
PyPI	salt	>= 3003.0, < 3003.5	3003.5
PyPI	salt	>= 3004.0, < 3004.2	3004.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-22967 advisory
https://github.com/advisories/GHSA-fpxm-fprw-6hxj advisory
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-210.yaml web
https://github.com/saltstack/salt package
https://repo.saltproject.io web
https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/, web
https://security.gentoo.org/glsa/202310-22 web