Description (CNA)
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / SaltStack Salt | affected SaltStack Salt prior to 3002.8, 3003.4, 3004.1 |
CWE
No CWE identifiers supplied.
References
- https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
- https://github.com/saltstack/salt/releases%2C
- https://repo.saltproject.io/
- https://security.gentoo.org/glsa/202310-22
ADP enrichment
No English description supplied.