Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:2253-1

Опубликовано: 04 июл. 2022
Источник: suse-cvrf

Описание

Security update for salt

This update for salt fixes the following issues:

  • CVE-2022-22967: Fixed missing check for PAM_ACCT_MGM return value that could be used to bypass authentication when using PAM (bsc#1200566)

Список пакетов

SUSE Linux Enterprise High Performance Computing 15-ESPOS
python3-salt-3004-150000.8.41.40.1
salt-3004-150000.8.41.40.1
salt-api-3004-150000.8.41.40.1
salt-bash-completion-3004-150000.8.41.40.1
salt-cloud-3004-150000.8.41.40.1
salt-doc-3004-150000.8.41.40.1
salt-fish-completion-3004-150000.8.41.40.1
salt-master-3004-150000.8.41.40.1
salt-minion-3004-150000.8.41.40.1
salt-proxy-3004-150000.8.41.40.1
salt-ssh-3004-150000.8.41.40.1
salt-standalone-formulas-configuration-3004-150000.8.41.40.1
salt-syndic-3004-150000.8.41.40.1
salt-transactional-update-3004-150000.8.41.40.1
salt-zsh-completion-3004-150000.8.41.40.1
SUSE Linux Enterprise High Performance Computing 15-LTSS
python3-salt-3004-150000.8.41.40.1
salt-3004-150000.8.41.40.1
salt-api-3004-150000.8.41.40.1
salt-bash-completion-3004-150000.8.41.40.1
salt-cloud-3004-150000.8.41.40.1
salt-doc-3004-150000.8.41.40.1
salt-fish-completion-3004-150000.8.41.40.1
salt-master-3004-150000.8.41.40.1
salt-minion-3004-150000.8.41.40.1
salt-proxy-3004-150000.8.41.40.1
salt-ssh-3004-150000.8.41.40.1
salt-standalone-formulas-configuration-3004-150000.8.41.40.1
salt-syndic-3004-150000.8.41.40.1
salt-transactional-update-3004-150000.8.41.40.1
salt-zsh-completion-3004-150000.8.41.40.1
SUSE Linux Enterprise Server 15-LTSS
python3-salt-3004-150000.8.41.40.1
salt-3004-150000.8.41.40.1
salt-api-3004-150000.8.41.40.1
salt-bash-completion-3004-150000.8.41.40.1
salt-cloud-3004-150000.8.41.40.1
salt-doc-3004-150000.8.41.40.1
salt-fish-completion-3004-150000.8.41.40.1
salt-master-3004-150000.8.41.40.1
salt-minion-3004-150000.8.41.40.1
salt-proxy-3004-150000.8.41.40.1
salt-ssh-3004-150000.8.41.40.1
salt-standalone-formulas-configuration-3004-150000.8.41.40.1
salt-syndic-3004-150000.8.41.40.1
salt-transactional-update-3004-150000.8.41.40.1
salt-zsh-completion-3004-150000.8.41.40.1
SUSE Linux Enterprise Server for SAP Applications 15
python3-salt-3004-150000.8.41.40.1
salt-3004-150000.8.41.40.1
salt-api-3004-150000.8.41.40.1
salt-bash-completion-3004-150000.8.41.40.1
salt-cloud-3004-150000.8.41.40.1
salt-doc-3004-150000.8.41.40.1
salt-fish-completion-3004-150000.8.41.40.1
salt-master-3004-150000.8.41.40.1
salt-minion-3004-150000.8.41.40.1
salt-proxy-3004-150000.8.41.40.1
salt-ssh-3004-150000.8.41.40.1
salt-standalone-formulas-configuration-3004-150000.8.41.40.1
salt-syndic-3004-150000.8.41.40.1
salt-transactional-update-3004-150000.8.41.40.1
salt-zsh-completion-3004-150000.8.41.40.1

Ссылки

Описание

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15-ESPOS:python3-salt-3004-150000.8.41.40.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-3004-150000.8.41.40.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-api-3004-150000.8.41.40.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS:salt-bash-completion-3004-150000.8.41.40.1
Ссылки
Уязвимость SUSE-SU-2022:2253-1