An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade salt | Aug 22, 2024 | Mar 29, 2022 |
| Gentoo Linux | — | Upgrade app-admin/salt. | Nov 1, 2023 | Mar 29, 2022 |
| Suse | — | Upgrade salt-proxyUpgrade salt-zsh-completionUpgrade salt-sshUpgrade salt-syndicUpgrade salt-fish-completionUpgrade salt-standalone-formulas-configurationUpgrade python3-saltUpgrade salt-masterUpgrade salt-apiUpgrade salt-minionUpgrade salt-bash-completionUpgrade saltUpgrade salt-docUpgrade salt-cloudUpgrade salt-transactional-updateUpgrade python2-salt | Oct 26, 2022 | Mar 29, 2022 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub