Is CVE-2022-22934 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-22934 being exploited in the wild.

How severe is CVE-2022-22934?

Low severity, with a CVSS score of 3.1, published 29 March 2022.

Which products and versions are affected?

salt (PyPI) ECOSYSTEM:introduced=0,fixed=3002.8; Saltstack Salt before 3002.8, 3003.4, 3004.1.

Is there a fix for CVE-2022-22934?

Yes. salt (PyPI): upgrade to 3002.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-22934 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2022-22934?

Check whether you run salt (PyPI) or Saltstack Salt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-22934: SaltStack Salt improper verification of cryptographic signature

CVE-2022-22934 · Severity: low · CVSS 3.1 · Published 2022-03-29

SaltStack Salt is an open-source infrastructure automation tool used by organizations to manage and provision servers at scale. A flaw in how pillar data (configuration and credentials) is transmitted from the server to clients allows an attacker positioned between them to intercept and substitute arbitrary pillar data without detection. An attacker exploiting this could inject malicious packages, credentials, or keys to compromise client machines.

Technologies: salt (PyPI), Saltstack Salt. Vendors: PyPI, Saltstack.

Quick answers

Is CVE-2022-22934 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-22934 being exploited in the wild.
How severe is CVE-2022-22934?: Low severity, with a CVSS score of 3.1, published 29 March 2022.
Which products and versions are affected?: salt (PyPI) ECOSYSTEM:introduced=0,fixed=3002.8; Saltstack Salt before 3002.8, 3003.4, 3004.1.
Is there a fix for CVE-2022-22934?: Yes. salt (PyPI): upgrade to 3002.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-22934 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2022-22934?: Check whether you run salt (PyPI) or Saltstack Salt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

salt (PyPI): upgrade to 3002.8 or later
```
pip install "salt>=3002.8"
```

Technical details

SaltStack Salt versions before 3002.8, 3003.4, and 3004.1 fail to cryptographically sign pillar data with the minion's public key, violating the integrity requirement for sensitive configuration. The vulnerability exists in the symmetric channel protocol variation used for pillar messages: neither the freshly generated encryption key nor the message payload is authenticated as originating from the server, enabling a man-in-the-middle attacker to forge and inject arbitrary pillar data if they know the client's public key (which is broadcast during key exchange). This affects all prior versions up to the fixed releases. The fix adds a server signature to pillar messages to prevent spoofing.

Affected products

SaltStack Salt before 3002.8, 3003.4, 3004.1

Identifiers

CVE-2022-22934
GHSA-2q4g-wfm6-5fpm
PYSEC-2022-171

Timeline

2022-03-30: disclosed
2022-03-28: patched: Patch released adding server signature to pillar messages

References

https://blog.cloudflare.com/future-proofing-saltstack

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.