未評価
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previous...
CVE-2022-22967
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory saltproject.io
- advisory security.gentoo.org
- web repo.saltproject.io