PT-2017-3951 · Saltstack+1 · Saltstack+1

Michael Scherer · Published 2015-02-02 · Updated 2022-05-17 · CVE-2015-1838

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SaltStack versions prior to 2014.7.4

Description The issue is related to the modules/serverdensity device.py module in SaltStack, which does not properly handle files in the /tmp directory. This can be exploited to gain unauthorized access to confidential data, cause a denial of service, or impact data integrity.

Recommendations For versions prior to 2014.7.4, update to version 2014.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

ALT-PU-2015-1126

ALT-PU-2018-2754

ALT-PU-2018-2755

ALT-PU-2018-2814

BDU:2020-02957

CVE-2015-1838

GHSA-92PW-MFF9-JQGM

PYSEC-2017-29

Affected Products

Alt Linux

Saltstack

References · 15

• https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1212784 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html · Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02957 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1838 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-1838 · Security Note
• https://ubuntu.com/security/CVE-2015-1838 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1838 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-1838 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-29 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-92pw-mff9-jqgm · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-29.yaml · Note