{"id":"CVE-2022-22935","aliases":["ALPINE-CVE-2022-22935","EUVD-2022-0271","GHSA-cvcc-5x92-gmhc","PYSEC-2022-172","SUSE-FU-2022:2042-1","SUSE-FU-2022:2135-1","SUSE-RU-2022:1385-1","SUSE-RU-2022:1389-1","SUSE-RU-2022:1391-1","SUSE-RU-2022:1392-1","SUSE-SU-2022:1049-1","SUSE-SU-2022:1050-1","SUSE-SU-2022:1051-1","SUSE-SU-2022:1057-1","SUSE-SU-2022:1058-1","SUSE-SU-2022:1059-1","SUSE-SU-2022:1060-1","SUSE-SU-2022:1514-1","SUSE-SU-2022:1536-1","SUSE-SU-2022:1545-1","UBUNTU-CVE-2022-22935","openSUSE-SU-2022:1059-1","openSUSE-SU-2024:11970-1"],"status":"published","title":"SaltStack Salt Improper Authentication via Man in the Middle Attack","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01501,"percentile":0.74484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-03-29T00:00:00Z","modified":"2026-11-03T07:30:10Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["3002.8","3003.4","3004.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"salt","fixed_in":["3004.1-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3003"},{"fixed":"3003.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3004"},{"fixed":"3004.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3002"},{"fixed":"3004.1-r0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.8"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5","2019.2.6","2019.2.7","2019.2.8","3000","3000.0.0rc1","3000.0.0rc2","3000.1","3000.2","3000.3","3000.4","3000.5","3000.6","3000.7","3000.8","3000.9","3001","3001.1","3001.2","3001.3","3001.4","3001.5","3001.6","3001.7","3001.8","3001rc1","3002","3002.1","3002.2","3002.3","3002.4","3002.5","3002.6","3002.7","3002rc1"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3003"},{"fixed":"3003.4"}]}],"versions":["3003","3003.1","3003.2","3003.3"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3004"},{"fixed":"3004.1"}]}],"versions":["3004"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.8"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","2014.7.4","2014.7.5","2014.7.6","2014.7.7","2015.2.0rc1","2015.2.0rc2","2015.5.0","2015.5.1","2015.5.10","2015.5.11","2015.5.2","2015.5.3","2015.5.4","2015.5.5","2015.5.6","2015.5.7","2015.5.8","2015.5.9","2015.8.0","2015.8.0rc1","2015.8.0rc2","2015.8.0rc3","2015.8.0rc4","2015.8.0rc5","2015.8.1","2015.8.10","2015.8.11","2015.8.12","2015.8.13","2015.8.2","2015.8.3","2015.8.4","2015.8.5","2015.8.7","2015.8.8","2015.8.8.2","2015.8.9","2016.11.0","2016.11.0rc1","2016.11.0rc2","2016.11.1","2016.11.10","2016.11.2","2016.11.3","2016.11.4","2016.11.5","2016.11.6","2016.11.7","2016.11.8","2016.11.9","2016.3.0","2016.3.0rc2","2016.3.0rc3","2016.3.1","2016.3.2","2016.3.3","2016.3.4","2016.3.5","2016.3.6","2016.3.7","2016.3.8","2017.7.0","2017.7.0rc1","2017.7.1","2017.7.2","2017.7.3","2017.7.4","2017.7.5","2017.7.6","2017.7.7","2017.7.8","2018.3.0","2018.3.0rc1","2018.3.1","2018.3.2","2018.3.3","2018.3.4","2018.3.5","2019.2.0","2019.2.0rc1","2019.2.0rc2","2019.2.1","2019.2.2","2019.2.3","2019.2.4","2019.2.5","2019.2.6","2019.2.7","2019.2.8","3000","3000.0.0rc1","3000.0.0rc2","3000.1","3000.2","3000.3","3000.4","3000.5","3000.6","3000.7","3000.8","3000.9","3001","3001.1","3001.2","3001.3","3001.4","3001.5","3001.6","3001.7","3001.8","3001rc1","3002","3002.1","3002.2","3002.3","3002.4","3002.5","3002.6","3002.7","3002rc1"]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3004-150000.3.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3004-3.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.63.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.63.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.63.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.63.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.63.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.63.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14.1-150200.3.77.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5.1-150300.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000-58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150000.8.41.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.57.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.57.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.57.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.57.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.57.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150100.57.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150200.58.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1","0.16.4-2","0.17.1+dfsg-1","0.17.2-1","0.17.2-2","0.17.2-3","0.17.4-1","0.17.4-2","0.17.5-1","0.17.5+ds-1","0.17.5+ds-1ubuntu0.1~esm1","0.17.5+ds-1ubuntu0.1~esm2","0.17.5+ds-1ubuntu0.1~esm4","0.17.5+ds-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.5.3+ds-1","2015.8.1+ds-2","2015.8.3+ds-1","2015.8.3+ds-2","2015.8.3+ds-3","2015.8.5+ds-1","2015.8.7+ds-1","2015.8.8+ds-1","2015.8.8+ds-1ubuntu0.1~esm1","2015.8.8+ds-1ubuntu0.1","2015.8.8+ds-1ubuntu0.1+esm1","2015.8.8+ds-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2016.11.5+ds-1","2016.11.8+dfsg1-1","2017.7.2+dfsg1-2ubuntu1","2017.7.3+dfsg1-1","2017.7.4+dfsg1-1","2017.7.4+dfsg1-1ubuntu18.04.1","2017.7.4+dfsg1-1ubuntu18.04.2","2017.7.4+dfsg1-1ubuntu18.04.2+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3002.2-150300.53.10.1"}]}],"bundled":4}],"products":[{"vendor":"saltstack","product":"salt"},{"vendor":"saltstack","product":"saltstack salt"}],"references":[{"url":"https://saltproject.io/security_announcements/salt-security-advisory-release/%2C","tags":["x_transferred","Broken Link","advisory"]},{"url":"https://github.com/saltstack/salt/releases%2C","tags":["x_transferred","Broken Link","web"]},{"url":"https://repo.saltproject.io/","tags":["x_transferred","Product","web","report"]},{"url":"https://security.gentoo.org/glsa/202310-22","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22935","tags":["advisory"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31","tags":["web"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L31","tags":["web"]},{"url":"https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L29","tags":["web"]},{"url":"https://saltproject.io/security_announcements/salt-security-advisory-release","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-172.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cvcc-5x92-gmhc","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-22935","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22935.json","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://github.com/saltstack/salt/releases,","tags":["web","report"]},{"url":"https://saltproject.io/security_announcements/salt-security-advisory-release/,","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/-2022-2042/suse-fu-20222042-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182851","tags":["report"]},{"url":"https://bugzilla.suse.com/1194632","tags":["report"]},{"url":"https://bugzilla.suse.com/1196050","tags":["report"]},{"url":"https://bugzilla.suse.com/1196432","tags":["report"]},{"url":"https://bugzilla.suse.com/1197417","tags":["report"]},{"url":"https://bugzilla.suse.com/1197637","tags":["report"]},{"url":"https://bugzilla.suse.com/1198556","tags":["report"]},{"url":"https://bugzilla.suse.com/1199149","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22941","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2022-2135/suse-fu-20222135-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2022-1385/suse-ru-20221385-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197533","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/-2022-1389/suse-ru-20221389-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2022-1391/suse-ru-20221391-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2022-1392/suse-ru-20221392-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221049-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221050-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221051-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221057-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221058-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221059-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221060-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221514-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221536-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1196249","tags":["report"]},{"url":"https://bugzilla.suse.com/1196877","tags":["report"]},{"url":"https://bugzilla.suse.com/1197279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24302","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221545-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1196338","tags":["report"]},{"url":"https://bugzilla.suse.com/1196704","tags":["report"]},{"url":"https://bugzilla.suse.com/1197042","tags":["report"]},{"url":"https://bugzilla.suse.com/1197579","tags":["report"]},{"url":"https://bugzilla.suse.com/1197689","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-22935","tags":["report"]},{"url":"https://saltproject.io/security_announcements/salt-security-advisory-release/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22935","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M6VBWD2MJTOPNB6DMK7CF6TQJ4N7ZFUD/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-22935","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T00:00:00Z","modified":"2025-05-05T16:28:44.531Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-0271","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T00:00:00Z","modified":"2025-05-05T16:28:44Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:32:56.549702Z"}],"ghsa":[{"id":"GHSA-cvcc-5x92-gmhc","title":"SaltStack Salt Improper Authentication via Man in the Middle Attack","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-30T00:00:20Z","modified":"2024-10-22T14:56:28Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2022-22935","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T17:15:15.22Z","modified":"2026-06-17T04:29:12.25Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"ALPINE-CVE-2022-22935","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T17:15:15.22Z","modified":"2026-11-03T07:30:10.392300982Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-22935","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T00:00:00Z","modified":"2026-10-28T02:30:34.037938013Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-cvcc-5x92-gmhc","title":"SaltStack Salt Improper Authentication via Man in the Middle Attack","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-30T00:00:20Z","modified":"2024-10-22T15:01:25.490785Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"UBUNTU-CVE-2022-22935","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T17:15:00Z","modified":"2026-04-08T13:47:20.608894Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"openSUSE-SU-2022:1059-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)\n- CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)\n- CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)\n- CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)\n","status":"published","published":"2022-03-30T15:33:09Z","modified":"2025-05-07T18:13:46.256894Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11970-1","title":"python3-salt-3004-5.1 on GA media","description":"These are all security issues fixed in the python3-salt-3004-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:12:58.25652Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-172","description":"An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.","status":"published","published":"2022-03-29T17:15:00Z","modified":"2026-06-10T17:02:40.067620392Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-FU-2022:2042-1","title":"Feature update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)\n- Fix the regression caused by the patch removing strict requirement for\n  OpenSSL 1.1.1 leading to read/write issues with ssl module for\n  SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Fix multiple security issues (bsc#1197417)\n  * CVE-2022-22935: Sign authentication replies to prevent MiTM.\n  * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.\n  * CVE-2022-22936: Prevent job and fileserver replays.\n  * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.\n- Salt version bump to 3004\n- Python version bump to 3.10.2\n- Clear network interfaces cache on grains request (bsc#1196050)\n- Add salt-ssh with Salt Bundle support (venv-salt-minion)\n  (bsc#1182851, bsc#1196432)\n- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)\n\n","status":"published","published":"2022-06-10T09:56:08Z","modified":"2025-05-02T03:45:31.665664Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-FU-2022:2135-1","title":"Feature update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)\n- Fix the regression caused by the patch removing strict requirement for\n  OpenSSL 1.1.1 leading to read/write issues with ssl module for\n  SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Fix multiple security issues (bsc#1197417)\n  * CVE-2022-22935: Sign authentication replies to prevent MiTM.\n  * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.\n  * CVE-2022-22936: Prevent job and fileserver replays\n  * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.\n- Salt version bump to 3004\n- Python version bump to 3.10.2\n- Clear network interfaces cache on grains request (bsc#1196050)\n- Add salt-ssh with Salt Bundle support (venv-salt-minion)\n  (bsc#1182851, bsc#1196432)\n- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)\n\n","status":"published","published":"2022-06-20T11:44:24Z","modified":"2026-02-04T02:56:30.074767Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2022:1385-1","title":"Recommended update for Salt","description":"This update fixes the following issues:\n\nsalt:\n\n- Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)\n- Prevent data pollution between actions processed at the same time (bsc#1197637)\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Remove duplicated method definitions in salt.netapi\n- Clear network interfaces cache on grains request (bsc#1196050)\n- Add salt-ssh with Salt Bundle support (venv-salt-minion)\n  (bsc#1182851, bsc#1196432)\n- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)\n\n","status":"published","published":"2022-04-25T14:40:30Z","modified":"2026-02-04T04:24:39.191768Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2022:1389-1","title":"Recommended update for salt","description":"This update for salt fixes the following issues:\n\n- Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)\n- Prevent data pollution between actions processed at the same time (bsc#1197637)\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Clear network interfaces cache on grains request (bsc#1196050)\n- Add salt-ssh with Salt Bundle support (venv-salt-minion)\n- Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)\n- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)\n","status":"published","published":"2022-04-25T14:41:23Z","modified":"2026-02-04T03:02:45.935887Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2022:1391-1","title":"Recommended update for salt","description":"This update for salt fixes the following issues:\n\n- Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)\n- Prevent data pollution between actions processed at the same time (bsc#1197637)  \n- Fix salt-ssh opts poisoning. (bsc#1197637)\n- Clear network interfaces cache on grains request. (bsc#1196050)\n- Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks. (bsc#1182851, bsc#1196432)\n- Restrict 'state.orchestrate_single' to pass a pillar value if it exists. (bsc#1194632)\n","status":"published","published":"2022-04-25T14:41:59Z","modified":"2026-02-04T03:24:31.348931Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2022:1392-1","title":"Recommended update for salt","description":"This update for salt fixes the following issues:\n\n- Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)\n- Prevent data pollution between actions processed at the same time (bsc#1197637)\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Clear network interfaces cache on grains request (bsc#1196050)\n- Add salt-ssh with Salt Bundle support (venv-salt-minion)\n- Fix Salt-API failure due to an exception from the scheduled SSH-Push Tasks (bsc#1182851, bsc#1196432)\n- Restrict 'state.orchestrate_single' to pass a pillar value if it exists (bsc#1194632)\n","status":"published","published":"2022-04-25T14:42:45Z","modified":"2026-02-04T02:44:39.558556Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:1049-1","title":"Security update for SUSE Manager 4.1.14.1 Release Notes","description":"This update for SUSE Manager 4.1.14.1 Release Notes provides the following additions:\n\nRelease notes for SUSE Manager:\n\n- Update to 4.1.14.1\n  * CVEs fixed\n    CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941\n  * Bugs mentioned\n    bsc#1197417\n","status":"published","published":"2022-03-30T14:30:03Z","modified":"2026-02-04T04:08:17.881456Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1050-1","title":"Security update for SUSE Manager 4.2.5.1 Release Notes","description":"This update for SUSE Manager 4.2.5.1 Release Notes provides the following additions:\n\nRelease notes for SUSE Manager:\n\n- Update to 4.2.5.1\n  * CVEs fixed\n    CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941\n  * Bugs mentioned\n    bsc#1197417\n","status":"published","published":"2022-03-30T14:30:14Z","modified":"2026-02-04T03:28:44.011881Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1051-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)\n- CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)\n- CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)\n- CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)\n","status":"published","published":"2022-03-30T15:53:25Z","modified":"2026-02-04T02:56:30.133305Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1057-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)\n- CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)\n- CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)\n- CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)\n","status":"published","published":"2022-03-30T15:37:55Z","modified":"2026-02-04T04:02:55.806878Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1058-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)\n- CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)\n- CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)\n- CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)\n","status":"published","published":"2022-03-30T16:01:16Z","modified":"2026-02-04T04:18:27.573946Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1059-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)\n- CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)\n- CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)\n- CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)\n","status":"published","published":"2022-03-30T15:33:12Z","modified":"2026-02-04T02:41:05.124573Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1060-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\n- CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417)\n- CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417)\n- CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417)\n- CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417)\n","status":"published","published":"2022-03-30T15:33:12Z","modified":"2026-02-04T02:23:00.045986Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1514-1","title":"Security Beta update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Fix the regression caused by the patch removing strict requirement for\n  OpenSSL 1.1.1 leading to read/write issues with ssl module for\n  SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)\n- Fixes for Python 3.10\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Fix multiple security issues (bsc#1197417)\n  * CVE-2022-22935: Sign authentication replies to prevent MiTM.\n  * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.\n  * CVE-2022-22936: Prevent job and fileserver replays.\n  * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.\n- Salt version bump to 3004\n- Python version bump to 3.10.2\n\n","status":"published","published":"2022-05-04T08:18:47Z","modified":"2026-02-04T04:07:55.691152Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1536-1","title":"Security Beta update for SUSE Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Fix the regression caused by the patch removing strict requirement for\n  OpenSSL 1.1.1 leading to read/write issues with ssl module for\n  SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)\n- Fixes for Python 3.10\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Fix multiple security issues (bsc#1197417)\n  * CVE-2022-22935: Sign authentication replies to prevent MiTM\n  * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.\n  * CVE-2022-22936: Prevent job and fileserver replays.\n  * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.\n- Salt version bump to 3004\n- Python version bump to 3.10.2\n- CVE-2022-24302: unauthorized information disclosure for python-paramiko.\n- CVE-2021-28957: XSS due to missing input sanitization in python-lxml.\n- CVE-2018-19787: XSS attacks due to missing URLs sanitization in python-lxml.\n- Security Fix: (bsc#1196249, bsc#1196877, CVE-2022-0778)\n  * Allow CRYPTO_THREADID_set_callback to be called with NULL parameter\n  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates \n","status":"published","published":"2022-05-04T13:33:28Z","modified":"2026-02-04T03:09:33.996286Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1545-1","title":"Security Beta update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- CVE-2022-21698: Denial of service using InstrumentHandlerCounter\n  * Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)\n- Update to version 0.23.0:\n  * amtool: Detect version drift and warn users (#2672)\n  * Add ability to skip TLS verification for amtool (#2663)\n  * Fix empty isEqual in amtool. (#2668)\n  * Fix main tests (#2670)\n  * cli: add new template render command (#2538)\n  * OpsGenie: refer to alert instead of incident (#2609)\n  * Docs: target_match and source_match are DEPRECATED (#2665)\n  * Fix test not waiting for cluster member to be ready\n- Added hardening to systemd service(s) (bsc#1181400).\n\ngolang-github-prometheus-prometheus:\n\n- Build firewalld-prometheus-config only for SUSE Linux Enterprise 15, 15.1 and 15.2, and require firewalld for it\n- Firewalld-prometheus-config needs to be a Recommends, not a\n  Requires, as prometheus does not require it to run\n- Create firewalld-prometheus-config subpackage (bsc#1197042)\n- CVE-2022-21698: Denial of service using InstrumentHandlerCounter. \n  * Update vendor tarball with prometheus/client_golang 1.12.1  (bsc#1196338)\n\nmgr-cfg:\n\n- Version 4.3.6-1\n  * Fix the condition for preventing building python 2 subpackage\n    for SLE15 (bsc#1197579)\n\nmgr-osad:\n\n- Version 4.3.6-1\n  * Fix the condition for preventing building python 2 subpackage\n    for SLE15\n\nmgr-push:\n\n- Version 4.3.4-1\n  * Fix the condition for preventing building python 2 subpackage\n    for SLE15\n\nmgr-virtualization:\n\n- Version 4.3.5-1\n  * Fix the condition for preventing building python 2 subpackage\n    for SLE15\n\nrhnlib:\n\n- Version 4.3.4-1\n  * Fix the condition for preventing building python 2 subpackage\n    for SLE15\n\nsalt:\n\n- Prevent data pollution between actions proceesed at the same time (bsc#1197637)\n- Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533)\n- Fixes for Python 3.10\n- Fix salt-ssh opts poisoning (bsc#1197637)\n- Fix multiple security issues for salt (bsc#1197417):\n  * CVE-2022-22935: Sign authentication replies to prevent MiTM.\n  * CVE-2022-22934: Sign pillar data to prevent MiTM attacks.\n  * CVE-2022-22936: Prevent job and fileserver replays. \n  * CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.\n\nspacecmd:\n\n- Version 4.3.10-1\n  * parse boolean parameters correctly (bsc#1197689)\n  * Add parameter to set containerized proxy SSH port\n\nspacewalk-client-tools:\n\n- Version 4.3.9-1\n  * Fix the condition for preventing building python 2 subpackage\n    for SLE15\n\nspacewalk-koan:\n\n- Version 4.3.5-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\nspacewalk-oscap:\n\n- Version 4.3.5-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\nsuseRegisterInfo:\n\n- Version 4.3.3-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\nuyuni-common-libs:\n\n- Version 4.3.4-1\n  * implement more decompression algorithms for reposync (bsc#1196704)\n\nuyuni-proxy-systemd-services:\n\n- Version 4.3.2-1\n  * Harmonize systemd services names and container names  \n  * Adapted to work on Enterprise Linux.\n  * Add package to SLE and Client tools (jsc#SLE-24145)\n","status":"published","published":"2022-05-05T10:11:10Z","modified":"2026-02-04T03:54:22.089932Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}