An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-salt | Aug 22, 2024 | Mar 29, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-app-admin-salt | Nov 1, 2023 | Mar 29, 2022 | |
| Suse | — | suse-upgrade-python2-saltsuse-upgrade-python3-saltsuse-upgrade-saltsuse-upgrade-salt-apisuse-upgrade-salt-bash-completionsuse-upgrade-salt-cloudsuse-upgrade-salt-docsuse-upgrade-salt-fish-completionsuse-upgrade-salt-mastersuse-upgrade-salt-minionsuse-upgrade-salt-proxysuse-upgrade-salt-sshsuse-upgrade-salt-standalone-formulas-configurationsuse-upgrade-salt-syndicsuse-upgrade-salt-transactional-updatesuse-upgrade-salt-zsh-completion | Oct 26, 2022 | Mar 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub