CVE-2022-22967

Advisory

Salt 3002.9, 3003.5 and 3004.2 include a fix for CVE-2022-22967: PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

========================

Fixed
-----

- Fixed an error when running on CentOS Stream 8. (59161)
- Fix bug in tcp transport (61865)
- Make sure the correct key is being used when verifying or validating communication, eg. when a Salt syndic is involved use syndic_master.pub and when a Salt minion is involved use minion_master.pub. (61868)


Security
--------

- Fixed PAM auth to reject auth attempt if user account is locked. (cve-2022-22967)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22967
• https://repo.saltproject.io/
• https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/,
• https://security.gentoo.org/glsa/202310-22