SB2022033041 - SUSE update for salt
Published: March 30, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Cryptographic issues (CVE-ID: CVE-2022-22934)
The vulnerability allows a remote attacker to manipulate data.
The vulnerability exists due to Salt Masters do not sign pillar data with the minion’s public key. A remote attacker can manipulate arbitrary pillar data.
2) Insufficient verification of data authenticity (CVE-ID: CVE-2022-22935)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper verification of data authenticity. A remote attacker with ability to perform MitM attack can impersonate a master and force a minion process to stop.
3) Authentication Bypass by Capture-replay (CVE-ID: CVE-2022-22936)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authentication in jobs. A remote attacker can perform a replay attack and force minions to run old jobs.
4) Incorrect permission assignment for critical resource (CVE-ID: CVE-2022-22941)
The vulnerability allows a remote user to compromise third-party minions.
The vulnerability exists due to improper permissions checks. A remote user can target any minion connected to the Syndic when configured as a Master-of-Masters, bypass publisher_acl and execute on any configured minion.
Remediation
Install update from vendor's website.