PT-2017-6526 · Saltstack+1 · Saltstack+1

Michael Scherer · Published 2015-02-02 · Updated 2022-05-17 · CVE-2015-1839

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SaltStack versions prior to 2014.7.4

Description The issue arises from improper handling of files in /tmp by the modules/chef.py module in SaltStack.

Recommendations For versions prior to 2014.7.4, update to version 2014.7.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

ALT-PU-2015-1126

CVE-2015-1839

GHSA-6GRP-75PQ-C8CJ

PYSEC-2017-30

Affected Products

Alt Linux

Saltstack

References · 13

• https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81 · Patch
• https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-1839 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1212788 · Patch
• https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-1839 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1839 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6grp-75pq-c8cj · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1839 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-30 · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-30.yaml · Note