Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2022-22967: SaltStack Salt fails to reject locked user accounts
CVE-2022-22967 · published 4 years ago
Summary
A bug in SaltStack Salt versions before 3002.9, 3003.5, and 3004.2 allows a locked user to continue accessing the system, potentially allowing them to perform actions they shouldn't have permission for. This affects both local user accounts and users who authenticate via a specific security feature. To fix this issue, update to the latest version of SaltStack Salt.
What to do
- Update thomas s hatch salt to version 3002.9.
- Update thomas s hatch salt to version 3003.5.
- Update thomas s hatch salt to version 3004.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | saltstack | salt |
< 3002.9 >= 3003, < 3003.5 >= 3004, < 3004.2 cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | salt | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | salt | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | salt | All versions |
| Ubuntu:22.04:LTS | canonical | salt | All versions |
| pip | thomas s hatch | salt |
< 3002.9 >= 3003.0, < 3003.5 >= 3004.0, < 3004.2 Fix: upgrade to 3002.9
|
Original advisory text
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked stil...
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
References
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-210.ya...
- https://saltproject.io/security_announcements/salt-security-advisory-release-jun...
- https://github.com/advisories/GHSA-fpxm-fprw-6hxj
- https://repo.saltproject.io
- https://repo.saltproject.io/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22967... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-22967 Vendor Advisory
- https://saltproject.io/security_announcements/salt-security-advisory-release-jun... Vendor Advisory
- https://security.gentoo.org/glsa/202310-22 Vendor Advisory
- https://saltproject.io/security_announcements/salt-security-advisory-release-jun... Third Party Advisory
- https://ubuntu.com/security/CVE-2022-22967 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-22967 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-863Incorrect Authorization
Timeline
Published22 Jun 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fpxm-fprw-6hxj · GHSA
CVE-2022-22967 · NVD
UBUNTU-CVE-2022-22967 · OSV
CVE-2022-22967 · OSV
Track software like this
Free during beta