CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22935
https://notcve.org/view.php?id=CVE-2022-22935
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master. Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.8, 3003.4, 3004.1. Una denegación de servicio de autenticación de minion puede causar que un atacante de tipo MiTM fuerce la detención de un proceso minion al suplantar a un master • https://github.com/saltstack/salt/releases%2C https://repo.saltproject.io https://saltproject.io/security_announcements/salt-security-advisory-release/%2C https://security.gentoo.org/glsa/202310-22 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22936
https://notcve.org/view.php?id=CVE-2022-22936
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios. Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.8, 3003.4, 3004.1. • https://github.com/saltstack/salt/releases%2C https://repo.saltproject.io https://saltproject.io/security_announcements/salt-security-advisory-release/%2C https://security.gentoo.org/glsa/202310-22 • CWE-294: Authentication Bypass by Capture-replay •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22941
https://notcve.org/view.php?id=CVE-2022-22941
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion. Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.8, 3003.4, 3004.1. Cuando es configurado como "Master-of-Masters", con un publisher_acl, si un usuario configurado en el publisher_acl apunta a cualquier minion conectado al Syndic, el Maestro de Salt interpreta incorrectamente que no presenta objetivos válidos, permitiendo a usuarios configurados apuntar a cualquiera de los minions conectados al syndic con sus comandos configurados. • https://github.com/saltstack/salt/releases%2C https://repo.saltproject.io https://saltproject.io/security_announcements/salt-security-advisory-release/%2C https://security.gentoo.org/glsa/202310-22 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-31607
https://notcve.org/view.php?id=CVE-2021-31607
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely). En SaltStack Salt versiones 2016.9 hasta 3002.6, se presenta una vulnerabilidad de inyección de comando en el módulo snapper que permite una escalada local de privilegios en un minion. El ataque requiere que sea creado un archivo con un nombre de ruta respaldado por snapper, y que el maestro llame a la función snapper.diff (que ejecuta popen de manera no segura) • https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-25315 – salt-api unauthenticated remote code execution
https://notcve.org/view.php?id=CVE-2021-25315
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. Una vulnerabilidad de Implementación Incorrecta del Algoritmo de Autenticación en SUSE SUSE Linux Enterprise Server versión 15 SP 3; openSUSE Tumbleweed, permite a atacantes locales ejecutar código arbitrario por medio de una sal sin la necesidad de especificar credenciales válidas. Este problema afecta a: salt de SUSE SUSE Linux Enterprise Server versión 15 SP 3 versiones anteriores a 3002.2-3. • https://bugzilla.suse.com/show_bug.cgi?id=1182382 • CWE-287: Improper Authentication •