What’s Vulnerable › Vulnerabilities

CVE-2022-22935

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-29 · updated 2026-06-17
• Weakness: CWE-287

Description

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

Affected products

• VMware SALT: from 3002 before 3002.8; from 3003 before 3003.4; from 3004 before 3004.1 — fixed in 3002.8, 3003.4, 3004.1

How to fix

Upgrade to a fixed version: VMware SALT 3002.8, 3003.4, 3004.1. Check the vendor advisory for mitigations.

References

• https://github.com/saltstack/salt/releases%2C
• https://repo.saltproject.io/
• https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
• https://security.gentoo.org/glsa/202310-22
• https://github.com/saltstack/salt/releases%2C
• https://repo.saltproject.io/
• https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
• https://security.gentoo.org/glsa/202310-22

Get alerted when CVE-2022-22935 or the next vulnerability affects your stack