CVE catalog
CVE-2022-22967
Security update for salt
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.06% · Oct 25, 2026
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | salt | pro | 0.16.0-1 | vulnerable |
| Ubuntu | salt | pro | 0.16.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.1+dfsg-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.2-3 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.4-2 | vulnerable |
| Ubuntu | salt | pro | 0.17.5-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm4 | vulnerable |
| Ubuntu | salt | pro | 0.17.5+ds-1ubuntu0.1~esm5 | vulnerable |
| Ubuntu | salt | pro | 2015.5.3+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.1+ds-2 | vulnerable |
| Ubuntu | salt | pro | 2015.8.3+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.3+ds-2 | vulnerable |
| Ubuntu | salt | pro | 2015.8.3+ds-3 | vulnerable |
| Ubuntu | salt | pro | 2015.8.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.7+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1+esm1 | vulnerable |
| Ubuntu | salt | pro | 2015.8.8+ds-1ubuntu0.1+esm2 | vulnerable |
| Ubuntu | salt | pro | 2016.11.5+ds-1 | vulnerable |
| Ubuntu | salt | pro | 2016.11.8+dfsg1-1 | vulnerable |
| Ubuntu | salt | pro | 2017.7.2+dfsg1-2ubuntu1 | vulnerable |
| Ubuntu | salt | pro | 2017.7.3+dfsg1-1 | vulnerable |
| Ubuntu | salt | pro | 2017.7.4+dfsg1-1 | vulnerable |
| Ubuntu | salt | pro | 2017.7.4+dfsg1-1ubuntu18.04.1 | vulnerable |
| Ubuntu | salt | pro | 2017.7.4+dfsg1-1ubuntu18.04.2 | vulnerable |
| Ubuntu | salt | pro | 2017.7.4+dfsg1-1ubuntu18.04.2+esm1 | vulnerable |
| Ubuntu | salt | 22.04 | 3002.6+dfsg1-4 | vulnerable |
| Ubuntu | salt | 22.04 | 3002.7+dfsg1-1 | vulnerable |
| Ubuntu | salt | 22.04 | 3004+dfsg1-4 | vulnerable |
| Ubuntu | salt | 22.04 | 3004+dfsg1-5 | vulnerable |
| Ubuntu | salt | 22.04 | 3004+dfsg1-6ubuntu1 | vulnerable |
| Ubuntu | salt | 22.04 | 3004+dfsg1-7 | vulnerable |
| Ubuntu | salt | 22.04 | 3004+dfsg1-8 | vulnerable |
| Ubuntu | salt | 22.04 | 3004.1+dfsg-2 | vulnerable |
| Suse | salt | linux enterprise module for basesystem 15 sp3 | 3004-150300.53.24.1 | fixed |
| Suse | salt | linux enterprise module for server applications 15 sp3 | 3004-150300.53.24.1 | fixed |
| Suse | salt | linux enterprise module for transactional server 15 sp3 | 3004-150300.53.24.1 | fixed |
| Suse | salt | linux enterprise micro 5.1 | 3004-150300.53.24.1 | fixed |
| Suse | salt | linux enterprise micro 5.2 | 3004-150300.53.24.1 | fixed |
| Opensuse | salt | leap 15.3 | 3004-150300.53.24.1 | fixed |
| Suse | salt | linux enterprise module for basesystem 15 sp4 | 3004-150400.8.8.1 | fixed |
| Suse | salt | linux enterprise module for server applications 15 sp4 | 3004-150400.8.8.1 | fixed |
| Suse | salt | linux enterprise module for transactional server 15 sp4 | 3004-150400.8.8.1 | fixed |
| Opensuse | salt | leap 15.4 | 3004-150400.8.8.1 | fixed |
| Suse | venv-salt-minion | manager client tools 12 | 3004-3.11.1 | fixed |
| Suse | salt | manager client tools 12 | 3000-65.1 | fixed |
| Suse | salt | linux enterprise module for advanced systems management 12 | 3000-65.1 | fixed |
| Suse | venv-salt-minion | manager client tools 15 | 3004-150000.3.11.1 | fixed |
| Suse | venv-salt-minion | manager proxy module 4.3 | 3004-150000.3.11.1 | fixed |
| Suse | venv-salt-minion | manager server module 4.3 | 3004-150000.3.11.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15 sp2-espos | 3004-150200.72.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15 sp2-ltss | 3004-150200.72.1 | fixed |
| Suse | salt | linux enterprise server 15 sp2-bcl | 3004-150200.72.1 | fixed |
| Suse | salt | linux enterprise server 15 sp2-ltss | 3004-150200.72.1 | fixed |
| Suse | salt | linux enterprise server for sap applications 15 sp2 | 3004-150200.72.1 | fixed |
| Suse | salt | manager proxy 4.1 | 3004-150200.72.1 | fixed |
| Suse | salt | manager retail branch server 4.1 | 3004-150200.72.1 | fixed |
| Suse | salt | manager server 4.1 | 3004-150200.72.1 | fixed |
| Suse | salt | enterprise storage 7 | 3004-150200.72.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15-espos | 3004-150000.8.41.40.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15-ltss | 3004-150000.8.41.40.1 | fixed |
| Suse | salt | linux enterprise server 15-ltss | 3004-150000.8.41.40.1 | fixed |
| Suse | salt | linux enterprise server for sap applications 15 | 3004-150000.8.41.40.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15 sp1-espos | 3004-150100.71.1 | fixed |
| Suse | salt | linux enterprise high performance computing 15 sp1-ltss | 3004-150100.71.1 | fixed |
| Suse | salt | linux enterprise server 15 sp1-bcl | 3004-150100.71.1 | fixed |
| Suse | salt | linux enterprise server 15 sp1-ltss | 3004-150100.71.1 | fixed |
| Suse | salt | linux enterprise server for sap applications 15 sp1 | 3004-150100.71.1 | fixed |
| Suse | salt | enterprise storage 6 | 3004-150100.71.1 | fixed |
| Opensuse | salt | leap micro 5.2 | 3004-150300.53.24.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Suse | salt | rpm | linux enterprise module for basesystem 15 sp3 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for server applications 15 sp3 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for transactional server 15 sp3 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-1 | Not reported |
| Suse | salt | rpm | linux enterprise micro 5.1 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-1 | Not reported |
| Suse | salt | rpm | linux enterprise micro 5.2 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-1 | Not reported |
| Opensuse | salt | rpm | leap 15.3 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for basesystem 15 sp4 | 3004-150400.8.8.1 | Not reported | SUSE-SU-2022:2304-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for server applications 15 sp4 | 3004-150400.8.8.1 | Not reported | SUSE-SU-2022:2304-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for transactional server 15 sp4 | 3004-150400.8.8.1 | Not reported | SUSE-SU-2022:2304-1 | Not reported |
| Opensuse | salt | rpm | leap 15.4 | 3004-150400.8.8.1 | Not reported | SUSE-SU-2022:2304-1 | Not reported |
| Suse | venv-salt-minion | rpm | manager client tools 12 | 3004-3.11.1 | Not reported | SUSE-SU-2022:3177-1 | Not reported |
| Suse | salt | rpm | manager client tools 12 | 3000-65.1 | Not reported | SUSE-SU-2022:2154-1 | Not reported |
| Suse | salt | rpm | linux enterprise module for advanced systems management 12 | 3000-65.1 | Not reported | SUSE-SU-2022:2154-1 | Not reported |
| Suse | venv-salt-minion | rpm | manager client tools 15 | 3004-150000.3.11.1 | Not reported | SUSE-SU-2022:3172-1 | Not reported |
| Suse | venv-salt-minion | rpm | manager proxy module 4.3 | 3004-150000.3.11.1 | Not reported | SUSE-SU-2022:3172-1 | Not reported |
| Suse | venv-salt-minion | rpm | manager server module 4.3 | 3004-150000.3.11.1 | Not reported | SUSE-SU-2022:3172-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15 sp2-espos | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15 sp2-ltss | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15 sp2-bcl | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15 sp2-ltss | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | linux enterprise server for sap applications 15 sp2 | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | manager proxy 4.1 | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | manager retail branch server 4.1 | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | manager server 4.1 | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | enterprise storage 7 | 3004-150200.72.1 | Not reported | SUSE-SU-2022:2278-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15-espos | 3004-150000.8.41.40.1 | Not reported | SUSE-SU-2022:2253-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15-ltss | 3004-150000.8.41.40.1 | Not reported | SUSE-SU-2022:2253-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15-ltss | 3004-150000.8.41.40.1 | Not reported | SUSE-SU-2022:2253-1 | Not reported |
| Suse | salt | rpm | linux enterprise server for sap applications 15 | 3004-150000.8.41.40.1 | Not reported | SUSE-SU-2022:2253-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15 sp1-espos | 3004-150100.71.1 | Not reported | SUSE-SU-2022:2159-1 | Not reported |
| Suse | salt | rpm | linux enterprise high performance computing 15 sp1-ltss | 3004-150100.71.1 | Not reported | SUSE-SU-2022:2159-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15 sp1-bcl | 3004-150100.71.1 | Not reported | SUSE-SU-2022:2159-1 | Not reported |
| Suse | salt | rpm | linux enterprise server 15 sp1-ltss | 3004-150100.71.1 | Not reported | SUSE-SU-2022:2159-1 | Not reported |
| Suse | salt | rpm | linux enterprise server for sap applications 15 sp1 | 3004-150100.71.1 | Not reported | SUSE-SU-2022:2159-1 | Not reported |
| Suse | salt | rpm | enterprise storage 6 | 3004-150100.71.1 | Not reported | SUSE-SU-2022:2159-1 | Not reported |
| Opensuse | salt | rpm | leap micro 5.2 | 3004-150300.53.24.1 | Not reported | SUSE-SU-2022:2178-2 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_2154-1.json]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2154-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2159-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2178-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2178-2]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2253-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2278-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2304-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:3172-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:3177-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-22967]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]