Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 855962 (CVE-2022-22967) - <app-admin/salt-{3002.9,3003.5,3004.2}: PAM fails to reject locked accounts
Summary: <app-admin/salt-{3002.9,3003.5,3004.2}: PAM fails to reject locked accounts
Status: RESOLVED FIXED
Alias: CVE-2022-22967
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://saltproject.io/security_annou...
Whiteboard: B4 [glsa+]
Keywords:
Depends on: 864823
Blocks:
  Show dependency tree
 
Reported: 2022-07-02 17:00 UTC by John Helmert III
Modified: 2023-10-31 12:00 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-02 17:00:12 UTC 
CVE-2022-22967:

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

Please stabilize a fixed version.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-13 23:35:03 UTC 
Please cleanup
Comment 2 Larry the Git Cow gentoo-dev 2023-10-31 11:57:51 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a4ba9f2fb65b65e29f00afe38eed9d10ac01301d

commit a4ba9f2fb65b65e29f00afe38eed9d10ac01301d
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-10-31 11:57:07 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2023-10-31 11:57:38 +0000

    [ GLSA 202310-22 ] Salt: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/767919
    Bug: https://bugs.gentoo.org/812440
    Bug: https://bugs.gentoo.org/836365
    Bug: https://bugs.gentoo.org/855962
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202310-22.xml | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)