SaltStack Salt vulnerabilities
We track 3 vulnerabilities in SaltStack Salt products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2022.
Latest SaltStack Salt vulnerabilities
- 8.8 High severity
SaltStack Salt: Incorrect Authorization
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects
- 8.8 High severity
SaltStack Salt: Incorrect Permission Assignment for Critical Resource
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly
- 8.8 High severity
SaltStack Salt: Authentication Bypass by Capture-replay
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server r