CVE-2022-22967: Salt's PAM auth fails to reject locked accounts
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.56019%
CWE
Published
6/25/2022
Updated
10/26/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 3002.9 | 3002.9 |
| salt | pip | >= 3003.0, < 3003.5 | 3003.5 |
| salt | pip | >= 3004.0, < 3004.2 | 3004.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper authorization checks in PAM authentication. Salt's PAM eAuth implementation would typically involve a function like pam.authenticate to handle PAM transactions. In PAM, account status checks (like locked/expired) are separate from credential validation (pam_authenticate). The vulnerability suggests this function either omitted or mishandled the pam_acct_mgmt step that checks account validity, allowing users with valid credentials but locked accounts to remain authenticated. This aligns with CWE-863 (Incorrect Authorization) and matches the described behavior where authorization isn't revoked upon account locking.