Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2022-22934

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

  • Published: Mar 29, 2022
  • Updated: Apr 14, 2023
  • CVE: CVE-2022-22934
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.8
  • AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 5.8
  • AV:A/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
saltstack / salt 3003 3003.4
saltstack / salt 3004 3004.1
saltstack / salt 3002 3002.8