Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/34517?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/34517?format=api", "purl": "pkg:pypi/salt@3004.1", "type": "pypi", "namespace": "", "name": "salt", "version": "3004.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "3005.2", "latest_non_vulnerable_version": "3007.9", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8877?format=api", "vulnerability_id": "VCID-6y9z-4cqf-dbhh", "summary": "Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-20897", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00154", "scoring_system": "epss", "scoring_elements": "0.35811", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-20897" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20897", "reference_id": "CVE-2023-20897", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20897" }, { "reference_url": "https://github.com/advisories/GHSA-vpjg-wmf8-29h9", "reference_id": "GHSA-vpjg-wmf8-29h9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vpjg-wmf8-29h9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/34526?format=api", "purl": "pkg:pypi/salt@3005.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3005.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/34525?format=api", "purl": "pkg:pypi/salt@3006.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.2" } ], "aliases": [ "CVE-2023-20897", "GHSA-vpjg-wmf8-29h9", "PYSEC-2023-166" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6y9z-4cqf-dbhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8878?format=api", "vulnerability_id": "VCID-r3m9-163d-myff", "summary": "Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-20898", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0009", "scoring_system": "epss", "scoring_elements": "0.25586", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-20898" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-169.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-169.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20898", "reference_id": "CVE-2023-20898", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20898" }, { "reference_url": "https://github.com/advisories/GHSA-qvh6-3j7x-3hq7", "reference_id": "GHSA-qvh6-3j7x-3hq7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qvh6-3j7x-3hq7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/34526?format=api", "purl": "pkg:pypi/salt@3005.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3005.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/34525?format=api", "purl": "pkg:pypi/salt@3006.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.2" } ], "aliases": [ "CVE-2023-20898", "GHSA-qvh6-3j7x-3hq7", "PYSEC-2023-169" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r3m9-163d-myff" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8354?format=api", "vulnerability_id": "VCID-7qmj-yzm7-yfhs", "summary": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22935", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21565", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22935" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-172.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-172.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L31", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L31" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L29", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L29" }, { "reference_url": "https://github.com/saltstack/salt/releases,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/releases," }, { "reference_url": "https://repo.saltproject.io/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io/" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-release", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-release" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-release/,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-release/," }, { "reference_url": "https://security.gentoo.org/glsa/202310-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202310-22" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22935", "reference_id": "CVE-2022-22935", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22935" }, { "reference_url": "https://github.com/advisories/GHSA-cvcc-5x92-gmhc", "reference_id": "GHSA-cvcc-5x92-gmhc", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cvcc-5x92-gmhc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20381?format=api", "purl": "pkg:pypi/salt@3002.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3qku-wmk8-5bg1" }, { "vulnerability": "VCID-5s8t-r4qa-yfb7" }, { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-anh6-63ah-sfhj" }, { "vulnerability": "VCID-dttu-htyd-tkcc" }, { "vulnerability": "VCID-r3m9-163d-myff" }, { "vulnerability": "VCID-z6gy-m65u-wqgh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3002.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/34513?format=api", "purl": "pkg:pypi/salt@3003.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/34517?format=api", "purl": "pkg:pypi/salt@3004.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3004.1" } ], "aliases": [ "CVE-2022-22935", "GHSA-cvcc-5x92-gmhc", "PYSEC-2022-172" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7qmj-yzm7-yfhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8356?format=api", "vulnerability_id": "VCID-84t6-tnd4-r3gq", "summary": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22936", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28645", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22936" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-173.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-173.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L32", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L32" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L30", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L30" }, { "reference_url": "https://github.com/saltstack/salt/releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/releases" }, { "reference_url": "https://github.com/saltstack/salt/releases,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/releases," }, { "reference_url": "https://repo.saltproject.io", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io" }, { "reference_url": "https://repo.saltproject.io/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io/" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-release", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-release" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-release/,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-release/," }, { "reference_url": "https://security.gentoo.org/glsa/202310-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202310-22" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22936", "reference_id": "CVE-2022-22936", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22936" }, { "reference_url": "https://github.com/advisories/GHSA-5r3f-3m3j-wcj2", "reference_id": "GHSA-5r3f-3m3j-wcj2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5r3f-3m3j-wcj2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20381?format=api", "purl": "pkg:pypi/salt@3002.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3qku-wmk8-5bg1" }, { "vulnerability": "VCID-5s8t-r4qa-yfb7" }, { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-anh6-63ah-sfhj" }, { "vulnerability": "VCID-dttu-htyd-tkcc" }, { "vulnerability": "VCID-r3m9-163d-myff" }, { "vulnerability": "VCID-z6gy-m65u-wqgh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3002.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/34513?format=api", "purl": "pkg:pypi/salt@3003.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/34517?format=api", "purl": "pkg:pypi/salt@3004.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3004.1" } ], "aliases": [ "CVE-2022-22936", "GHSA-5r3f-3m3j-wcj2", "PYSEC-2022-173" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-84t6-tnd4-r3gq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8355?format=api", "vulnerability_id": "VCID-9cpe-uywb-zfbc", "summary": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22934", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0012", "scoring_system": "epss", "scoring_elements": "0.3065", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22934" }, { "reference_url": "https://blog.cloudflare.com/future-proofing-saltstack", "reference_id": "", "reference_type": "", "scores": [], "url": "https://blog.cloudflare.com/future-proofing-saltstack" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-171.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-171.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://github.com/saltstack/salt/releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/releases" }, { "reference_url": "https://github.com/saltstack/salt/releases,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/releases," }, { "reference_url": "https://repo.saltproject.io", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io" }, { "reference_url": "https://repo.saltproject.io/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io/" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-release/,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-release/," }, { "reference_url": "https://security.gentoo.org/glsa/202310-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202310-22" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22934", "reference_id": "CVE-2022-22934", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22934" }, { "reference_url": "https://github.com/advisories/GHSA-2q4g-wfm6-5fpm", "reference_id": "GHSA-2q4g-wfm6-5fpm", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2q4g-wfm6-5fpm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20381?format=api", "purl": "pkg:pypi/salt@3002.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3qku-wmk8-5bg1" }, { "vulnerability": "VCID-5s8t-r4qa-yfb7" }, { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-anh6-63ah-sfhj" }, { "vulnerability": "VCID-dttu-htyd-tkcc" }, { "vulnerability": "VCID-r3m9-163d-myff" }, { "vulnerability": "VCID-z6gy-m65u-wqgh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3002.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/34513?format=api", "purl": "pkg:pypi/salt@3003.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/34517?format=api", "purl": "pkg:pypi/salt@3004.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3004.1" } ], "aliases": [ "CVE-2022-22934", "GHSA-2q4g-wfm6-5fpm", "PYSEC-2022-171" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9cpe-uywb-zfbc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8353?format=api", "vulnerability_id": "VCID-n4vy-d4dh-x7gu", "summary": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22941", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03679", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22941" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-174.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2022-174.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.8.rst#L31" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L32", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3003.4.rst#L32" }, { "reference_url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L30", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3004.1.rst#L30" }, { "reference_url": "https://github.com/saltstack/salt/releases,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/releases," }, { "reference_url": "https://repo.saltproject.io", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io" }, { "reference_url": "https://repo.saltproject.io/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://repo.saltproject.io/" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-release/,", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-release/," }, { "reference_url": "https://security.gentoo.org/glsa/202310-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202310-22" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22941", "reference_id": "CVE-2022-22941", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22941" }, { "reference_url": "https://github.com/advisories/GHSA-qcr3-hr2f-6557", "reference_id": "GHSA-qcr3-hr2f-6557", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qcr3-hr2f-6557" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20381?format=api", "purl": "pkg:pypi/salt@3002.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3qku-wmk8-5bg1" }, { "vulnerability": "VCID-5s8t-r4qa-yfb7" }, { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-anh6-63ah-sfhj" }, { "vulnerability": "VCID-dttu-htyd-tkcc" }, { "vulnerability": "VCID-r3m9-163d-myff" }, { "vulnerability": "VCID-z6gy-m65u-wqgh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3002.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/34513?format=api", "purl": "pkg:pypi/salt@3003.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/34517?format=api", "purl": "pkg:pypi/salt@3004.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6y9z-4cqf-dbhh" }, { "vulnerability": "VCID-r3m9-163d-myff" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3004.1" } ], "aliases": [ "CVE-2022-22941", "GHSA-qcr3-hr2f-6557", "PYSEC-2022-174" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n4vy-d4dh-x7gu" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3004.1" }