PT-2017-7094 · Saltstack+1 · Salt+1

Adam Mariš · Publicado 2017-08-09 · Atualizado 2022-05-17 · CVE-2015-6941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salt versions 2015.5.x through 2015.5.5 Salt versions 2015.8.x through 2015.8.0

Description The issue concerns the leakage of password information in debug logs, specifically affecting the win useradd, salt-cloud, and the Linode driver components.

Recommendations For Salt versions 2015.5.x through 2015.5.5, update to version 2015.5.6 or later. For Salt versions 2015.8.x through 2015.8.0, update to version 2015.8.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-534

Identificadores relacionados

CVE-2015-6941

GHSA-CXM4-7QCW-267R

PYSEC-2017-71

USN-4769-1

Produtos afetados

Salt

Ubuntu

Referências · 23

• https://github.com/saltstack/salt · Nota
• https://github.com/saltstack/salt/commit/fdd35374562658f4a20767a3703fab93d92f9ca9 · Nota
• https://github.com/saltstack/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-71.yaml · Nota
• https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-6941 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-4769-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cxm4-7qcw-267r · Aviso do Fabricante
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14696 · Aviso do Fabricante
• https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-6941 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14695 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-15751 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-6941 · Nota de Segurança