CVSS 3.1
8.8 highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-22934
High (8.8) in saltstack salt. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in salt 3002.8, 3003.4, 3004.1.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saltstack:salt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2q4g-wfm6-5fpm | PyPI | salt | <3002.8 | 3002.8 |
| GHSA-2q4g-wfm6-5fpm | PyPI | salt | >=3004 <3004.1 | 3004.1 |
| GHSA-2q4g-wfm6-5fpm | PyPI | salt | >=3003 <3003.4 | 3003.4 |
| PYSEC-2022-171 | PyPI | salt | <3002.8 | 3002.8 |