Incorrect permission assignment for critical resource in Salt - CVE-2022-22941

Vulnerability identifier: #VU82817

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22941

CWE-ID: CWE-732

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise third-party minions.

The vulnerability exists due to improper permissions checks. A remote user can target any minion connected to the Syndic when configured as a Master-of-Masters, bypass publisher_acl and execute on any configured minion.

Salt
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Manager Debian
SUSE Manager Tools
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Advanced Systems Management
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Transactional Server
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
SUSE Manager Ubuntu
firewalld-prometheus-config
golang-github-prometheus-promu
golang-github-prometheus-alertmanager
golang-github-prometheus-node_exporter
golang-github-prometheus-prometheus
release-notes-susemanager
uyuni-proxy-systemd-services
python2-suseRegisterInfo
suseRegisterInfo
python3-suseRegisterInfo
python2-uyuni-common-libs
python2-mgr-push
mgr-push
python2-rhnlib
python3-uyuni-common-libs
python3-mgr-push
python3-rhnlib
python2-mgr-virtualization-host
python2-mgr-virtualization-common
mgr-virtualization-host
spacewalk-oscap
python2-spacewalk-oscap
spacewalk-koan
python2-spacewalk-koan
python3-mgr-virtualization-host
python3-mgr-virtualization-common
python3-spacewalk-koan
python3-spacewalk-oscap
python2-mgr-cfg-actions
python2-mgr-cfg
mgr-cfg
python2-mgr-cfg-client
mgr-cfg-client
python2-mgr-cfg-management
python2-mgr-osa-common
python2-mgr-osad
mgr-cfg-actions
mgr-osad
mgr-cfg-management
python3-mgr-cfg
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-cfg-management
python3-mgr-osa-common
python3-mgr-osad
spacewalk-client-tools
python2-spacewalk-client-setup
python2-spacewalk-client-tools
spacewalk-check
spacewalk-client-setup
python2-spacewalk-check
python3-spacewalk-client-tools
python3-spacewalk-client-setup
python3-spacewalk-check
spacecmd
salt-minion
salt-common
python2-salt
salt-doc
salt
python3-salt
salt-standalone-formulas-configuration
salt-syndic
salt-bash-completion
salt-zsh-completion
salt-ssh
salt-proxy
salt-master
salt-cloud
salt-api
salt-fish-completion
salt-transactional-update
app-admin/salt
venv-salt-minion

Install updates from vendor's website.

Salt - addressed in versions 3002.8, 3003.4, 3004.1
firewalld-prometheus-config - update to 0.1-159000.6.30.4
golang-github-prometheus-promu - update to 0.13.0-4.9.1
golang-github-prometheus-alertmanager - addressed in versions 0.23.0-4.9.1, 0.23.0-159000.6.9.3
golang-github-prometheus-node_exporter - update to 1.3.0-4.12.1
golang-github-prometheus-prometheus - addressed in versions 2.32.1-4.30.1, 2.32.1-159000.6.30.4
release-notes-susemanager - addressed in versions 4.1.14.1-150200.3.77.1, 4.2.5.1-150300.3.34.1
uyuni-proxy-systemd-services - update to 4.3.2-159000.3.6.1
python2-suseRegisterInfo - update to 4.3.3-28.21.1
suseRegisterInfo - addressed in versions 4.3.3-28.21.1, 4.3.3-159000.6.21.2
python3-suseRegisterInfo - update to 4.3.3-159000.6.21.2
python2-uyuni-common-libs - update to 4.3.4-3.30.1
python2-mgr-push - update to 4.3.4-4.18.1
mgr-push - addressed in versions 4.3.4-4.18.1, 4.3.4-159000.4.18.2
python2-rhnlib - update to 4.3.4-24.27.1
python3-uyuni-common-libs - update to 4.3.4-159000.3.30.2
python3-mgr-push - update to 4.3.4-159000.4.18.2
python3-rhnlib - update to 4.3.4-159000.6.27.2
python2-mgr-virtualization-host - update to 4.3.5-4.18.1
python2-mgr-virtualization-common - update to 4.3.5-4.18.1
mgr-virtualization-host - addressed in versions 4.3.5-4.18.1, 4.3.5-159000.4.18.2
spacewalk-oscap - addressed in versions 4.3.5-22.18.1, 4.3.5-159000.6.18.2
python2-spacewalk-oscap - update to 4.3.5-22.18.1
spacewalk-koan - addressed in versions 4.3.5-27.18.1, 4.3.5-159000.6.18.1
python2-spacewalk-koan - update to 4.3.5-27.18.1
python3-mgr-virtualization-host - update to 4.3.5-159000.4.18.2
python3-mgr-virtualization-common - update to 4.3.5-159000.4.18.2
python3-spacewalk-koan - update to 4.3.5-159000.6.18.1
python3-spacewalk-oscap - update to 4.3.5-159000.6.18.2
python2-mgr-cfg-actions - update to 4.3.6-4.27.1
python2-mgr-cfg - update to 4.3.6-4.27.1
mgr-cfg - addressed in versions 4.3.6-4.27.1, 4.3.6-159000.4.26.1
python2-mgr-cfg-client - update to 4.3.6-4.27.1
mgr-cfg-client - addressed in versions 4.3.6-4.27.1, 4.3.6-159000.4.26.1
python2-mgr-cfg-management - update to 4.3.6-4.27.1
python2-mgr-osa-common - update to 4.3.6-4.27.1
python2-mgr-osad - update to 4.3.6-4.27.1
mgr-cfg-actions - addressed in versions 4.3.6-4.27.1, 4.3.6-159000.4.26.1
mgr-osad - addressed in versions 4.3.6-4.27.1, 4.3.6-159000.4.27.2
mgr-cfg-management - addressed in versions 4.3.6-4.27.1, 4.3.6-159000.4.26.1
python3-mgr-cfg - update to 4.3.6-159000.4.26.1
python3-mgr-cfg-actions - update to 4.3.6-159000.4.26.1
python3-mgr-cfg-client - update to 4.3.6-159000.4.26.1
python3-mgr-cfg-management - update to 4.3.6-159000.4.26.1
python3-mgr-osa-common - update to 4.3.6-159000.4.27.2
python3-mgr-osad - update to 4.3.6-159000.4.27.2
spacewalk-client-tools - addressed in versions 4.3.9-55.45.1, 4.3.9-159000.6.45.2
python2-spacewalk-client-setup - update to 4.3.9-55.45.1
python2-spacewalk-client-tools - update to 4.3.9-55.45.1
spacewalk-check - addressed in versions 4.3.9-55.45.1, 4.3.9-159000.6.45.2
spacewalk-client-setup - addressed in versions 4.3.9-55.45.1, 4.3.9-159000.6.45.2
python2-spacewalk-check - update to 4.3.9-55.45.1
python3-spacewalk-client-tools - update to 4.3.9-159000.6.45.2
python3-spacewalk-client-setup - update to 4.3.9-159000.6.45.2
python3-spacewalk-check - update to 4.3.9-159000.6.45.2
spacecmd - addressed in versions 4.3.10-2.32.1, 4.3.10-2.33.1, 4.3.10-2.39.1, 4.3.10-41.39.1, 4.3.10-159000.6.39.2
salt-minion - addressed in versions 3000+ds-1+2.45.1, 3000-53.11.1, 3000-58.1, 3002.2+ds-1+2.45.1, 3002.2+ds-1+2.66.1, 3002.2+ds-1+107.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004+ds-1+2.39.1, 3004+ds-1+2.42.1, 3004+ds-1+27.57.1, 3004-159000.8.56.1
salt-common - addressed in versions 3000+ds-1+2.45.1, 3002.2+ds-1+2.45.1, 3002.2+ds-1+2.66.1, 3002.2+ds-1+107.1, 3004+ds-1+2.39.1, 3004+ds-1+2.42.1, 3004+ds-1+27.57.1
python2-salt - addressed in versions 3000-53.11.1, 3000-58.1
salt-doc - addressed in versions 3000-53.11.1, 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt - addressed in versions 3000-53.11.1, 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
python3-salt - addressed in versions 3000-53.11.1, 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-standalone-formulas-configuration - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-syndic - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-bash-completion - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-zsh-completion - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-ssh - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-proxy - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-master - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-cloud - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-api - addressed in versions 3000-58.1, 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-fish-completion - addressed in versions 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
salt-transactional-update - addressed in versions 3002.2-150000.8.41.26.1, 3002.2-150100.57.1, 3002.2-150200.58.1, 3002.2-150300.53.10.1, 3004-159000.8.56.1
app-admin/salt - update to 3004.2
venv-salt-minion - addressed in versions 3004-2.9.1, 3004-2.9.2, 3004-2.11.2, 3004-3.9.1, 3004-159000.3.9.1

• https://saltproject.io/security_announcements/salt-security-advisory-release/
• https://security.gentoo.org/glsa/202310-22

• Multiple vulnerabilities in SaltStack Salt
• Gentoo update for Salt
• SUSE update for SUSE Manager 4.1.14.1 Release Notes
• SUSE update for SUSE Manager 4.2.5.1 Release Notes
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Client Tools
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• SUSE update for Security Beta update for SUSE Manager Client Tools