中危 saltstack salt 授权机制不正确

CVE编号

CVE-2022-22967

利用情况

暂无

补丁情况

官方补丁

披露时间

2022-06-24

漏洞描述

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://repo.saltproject.io/
https://saltproject.io/security_announcements/salt-security-advisory-release-...
https://security.gentoo.org/glsa/202310-22

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	saltstack	salt	*		Up to (excluding) 3002.9
	运行在以下环境
	应用	saltstack	salt	*	From (including) 3003	Up to (excluding) 3003.5
	运行在以下环境
	应用	saltstack	salt	*	From (including) 3004	Up to (excluding) 3004.2
	运行在以下环境
	系统	debian_10	salt	*		Up to (including) 2018.3.4+dfsg1-6+deb10u3
	运行在以下环境
	系统	debian_11	salt	*		Up to (including) 3002.6+dfsg1-4+deb11u1
	运行在以下环境
	系统	debian_12	salt	*		Up to (including) 3004.1+dfsg-2
	运行在以下环境
	系统	debian_9	salt	*		Up to (including) 2016.11.2+ds-1+deb9u4
	运行在以下环境
	系统	debian_sid	salt	*		Up to (including) 3004.1+dfsg-2.2
	运行在以下环境
	系统	opensuse_5.2	salt	*		Up to (excluding) 3004-150300.53.24.1
	运行在以下环境
	系统	opensuse_Leap_15.3	salt	*		Up to (excluding) 3004-150300.53.24.1
	运行在以下环境
	系统	opensuse_Leap_15.4	salt	*		Up to (excluding) 3004-150400.8.8.1

阿里云评分 6.8

• 攻击路径 本地
• 攻击复杂度 复杂
• 权限要求 无需权限
• 影响范围 越权影响
• EXP成熟度 未验证
• 补丁情况 官方补丁
• 数据保密性 数据泄露
• 数据完整性 无影响
• 服务器危害 无影响
• 全网数量 N/A

CWE-ID	漏洞类型
CWE-863	授权机制不正确

Exp相关链接

- avd.aliyun.com