salt-minion: Version 3005.1 marks as vulnerable and they are not #4421

rrodriguez-cdmon · 2023-05-17T10:06:50Z

rrodriguez-cdmon
May 17, 2023

IDs

CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941, CVE-2022-22967

Description

Trivy marks salt-minion version 3005.1 as vulnerable and they do not appear as affected versions in the CVE databases:

https://avd.aquasec.com/nvd/2022/cve-2022-22934/
https://avd.aquasec.com/nvd/2022/cve-2022-22935/
https://avd.aquasec.com/nvd/2022/cve-2022-22936/
https://avd.aquasec.com/nvd/2022/cve-2022-22941/
https://avd.aquasec.com/nvd/2022/cve-2022-22967/

Reproduction Steps

# trivy rootfs / --scanners vuln --format json -q > trivy.txt
# vim trivy.txt
...
{
          "VulnerabilityID": "CVE-2022-22934",
          "PkgID": "[email protected]+ds-1",
          "PkgName": "salt-common",
          "InstalledVersion": "3005.1+ds-1",
          "Layer": {},
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-22934",
          "DataSource": {
            "ID": "debian",
            "Name": "Debian Security Tracker",
            "URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
          },
          "Title": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3 ...",
          "Description": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-347"
          ],
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 5.8,
              "V3Score": 8.8
            }
          },
          "References": [
            "https://github.com/saltstack/salt/releases,",
            "https://repo.saltproject.io/",
            "https://saltproject.io/security_announcements/salt-security-advisory-release/,"
          ],
          "PublishedDate": "2022-03-29T17:15:00Z",
          "LastModifiedDate": "2022-04-06T20:48:00Z"
        },
...

Target

Filesystem

Scanner

Vulnerability

Target OS

Debian 11

Debug Output

# trivy rootfs / --scanners vuln --debug
2023-05-17T12:06:16.586+0200	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-05-17T12:06:16.590+0200	DEBUG	cache dir:  /root/.cache/trivy
2023-05-17T12:06:16.590+0200	DEBUG	DB update was skipped because the local DB is the latest
2023-05-17T12:06:16.590+0200	DEBUG	DB Schema: 2, UpdatedAt: 2023-05-17 06:09:28.766768241 +0000 UTC, NextUpdate: 2023-05-17 12:09:28.766768041 +0000 UTC, DownloadedAt: 2023-05-17 10:04:37.841778574 +0000 UTC
2023-05-17T12:06:16.590+0200	INFO	Vulnerability scanning is enabled
2023-05-17T12:06:16.590+0200	DEBUG	Vulnerability type:  [os library]
2023-05-17T12:06:16.591+0200	DEBUG	Walk the file tree rooted at '/' in parallel
2023-05-17T12:06:16.591+0200	DEBUG	Skipping directory: proc
2023-05-17T12:06:16.795+0200	DEBUG	Skipping directory: dev
2023-05-17T12:06:16.795+0200	DEBUG	Skipping directory: sys
2023-05-17T12:06:16.813+0200	DEBUG	Analysis error: go binary (filepath: usr/local/lib/python3.9/dist-packages/mysql/vendor/libssl.so.1.1) parse error: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/libssl.so.1.1: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/libssl.so.1.1: EOF
2023-05-17T12:06:16.814+0200	DEBUG	Analysis error: go binary (filepath: usr/local/lib/python3.9/dist-packages/mysql/vendor/libcrypto.so.1.1) parse error: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/libcrypto.so.1.1: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/libcrypto.so.1.1: EOF
2023-05-17T12:06:16.814+0200	DEBUG	Analysis error: go binary (filepath: usr/local/lib/python3.9/dist-packages/mysql/vendor/private/libssl.so.1.1) parse error: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/private/libssl.so.1.1: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/private/libssl.so.1.1: EOF
2023-05-17T12:06:16.814+0200	DEBUG	Analysis error: go binary (filepath: usr/local/lib/python3.9/dist-packages/mysql/vendor/private/libcrypto.so.1.1) parse error: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/private/libcrypto.so.1.1: failed to parse usr/local/lib/python3.9/dist-packages/mysql/vendor/private/libcrypto.so.1.1: EOF
2023-05-17T12:06:17.290+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/cat) parse error: failed to parse usr/lib/klibc/bin/cat: failed to parse usr/lib/klibc/bin/cat: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/nuke) parse error: failed to parse usr/lib/klibc/bin/nuke: failed to parse usr/lib/klibc/bin/nuke: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/minips) parse error: failed to parse usr/lib/klibc/bin/minips: failed to parse usr/lib/klibc/bin/minips: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/pivot_root) parse error: failed to parse usr/lib/klibc/bin/pivot_root: failed to parse usr/lib/klibc/bin/pivot_root: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/mkfifo) parse error: failed to parse usr/lib/klibc/bin/mkfifo: failed to parse usr/lib/klibc/bin/mkfifo: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/mount) parse error: failed to parse usr/lib/klibc/bin/mount: failed to parse usr/lib/klibc/bin/mount: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/readlink) parse error: failed to parse usr/lib/klibc/bin/readlink: failed to parse usr/lib/klibc/bin/readlink: EOF
2023-05-17T12:06:17.290+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/sleep) parse error: failed to parse usr/lib/klibc/bin/sleep: failed to parse usr/lib/klibc/bin/sleep: EOF
2023-05-17T12:06:17.291+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/mv) parse error: failed to parse usr/lib/klibc/bin/mv: failed to parse usr/lib/klibc/bin/mv: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/resume) parse error: failed to parse usr/lib/klibc/bin/resume: failed to parse usr/lib/klibc/bin/resume: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/chroot) parse error: failed to parse usr/lib/klibc/bin/chroot: failed to parse usr/lib/klibc/bin/chroot: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/losetup) parse error: failed to parse usr/lib/klibc/bin/losetup: failed to parse usr/lib/klibc/bin/losetup: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/dmesg) parse error: failed to parse usr/lib/klibc/bin/dmesg: failed to parse usr/lib/klibc/bin/dmesg: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/ln) parse error: failed to parse usr/lib/klibc/bin/ln: failed to parse usr/lib/klibc/bin/ln: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/kill) parse error: failed to parse usr/lib/klibc/bin/kill: failed to parse usr/lib/klibc/bin/kill: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/false) parse error: failed to parse usr/lib/klibc/bin/false: failed to parse usr/lib/klibc/bin/false: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/true) parse error: failed to parse usr/lib/klibc/bin/true: failed to parse usr/lib/klibc/bin/true: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/uname) parse error: failed to parse usr/lib/klibc/bin/uname: failed to parse usr/lib/klibc/bin/uname: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/sync) parse error: failed to parse usr/lib/klibc/bin/sync: failed to parse usr/lib/klibc/bin/sync: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/umount) parse error: failed to parse usr/lib/klibc/bin/umount: failed to parse usr/lib/klibc/bin/umount: EOF
2023-05-17T12:06:17.292+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/mknod) parse error: failed to parse usr/lib/klibc/bin/mknod: failed to parse usr/lib/klibc/bin/mknod: EOF
2023-05-17T12:06:17.293+0200	DEBUG	Analysis error: go binary (filepath: usr/lib/klibc/bin/mkdir) parse error: failed to parse usr/lib/klibc/bin/mkdir: failed to parse usr/lib/klibc/bin/mkdir: EOF
...

Version

# trivy --version
Version: 0.41.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-05-17 06:09:28.766768241 +0000 UTC
  NextUpdate: 2023-05-17 12:09:28.766768041 +0000 UTC
  DownloadedAt: 2023-05-17 10:04:37.841778574 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-05-16 00:49:53.281401489 +0000 UTC
  NextUpdate: 2023-05-19 00:49:53.281400789 +0000 UTC
  DownloadedAt: 2023-05-16 05:01:43.334005792 +0000 UTC

Checklist

Read the documentation regarding wrong detection
Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

knqyf263 · 2023-05-17T10:27:28Z

knqyf263
May 17, 2023
Maintainer

They should be vulnerable as Debian 11 doesn't have patches.
https://security-tracker.debian.org/tracker/CVE-2022-22934

0 replies

rrodriguez-cdmon · 2023-05-17T10:33:21Z

rrodriguez-cdmon
May 17, 2023
Author

But in this case we have installed the official package of the specific manufacturer for Debian, although in the official Debian repos they still do not have this version deployed, the manufacturer serves this package.

https://repo.saltproject.io/salt/py3/debian/
https://docs.saltproject.io/salt/install-guide/en/latest/topics/install-by-operating-system/debian.html#install-debian
https://docs.saltproject.io/salt/install-guide/en/latest/topics/install-by-operating-system/debian.html#install-salt-on-debian-11-bullseye

1 reply

knqyf263 May 17, 2023
Maintainer

Oh, you're right. If it is not an official package, those vulnerabilities should not be detected. I think it is the same issue as #1886

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

salt-minion: Version 3005.1 marks as vulnerable and they are not #4421

{{title}}

Replies: 2 comments 1 reply

{{title}}

{{title}}

{{title}}

Select a reply

salt-minion: Version 3005.1 marks as vulnerable and they are not #4421

rrodriguez-cdmon May 17, 2023

IDs

Description

Reproduction Steps

Target

Scanner

Target OS

Debug Output

Version

Checklist

Replies: 2 comments · 1 reply

knqyf263 May 17, 2023 Maintainer

rrodriguez-cdmon May 17, 2023 Author

knqyf263 May 17, 2023 Maintainer

rrodriguez-cdmon
May 17, 2023

Replies: 2 comments 1 reply

knqyf263
May 17, 2023
Maintainer

rrodriguez-cdmon
May 17, 2023
Author

knqyf263 May 17, 2023
Maintainer