PT-2017-7094 · Saltstack+1 · Salt+1

Adam Mariš · Published 2017-08-09 · Updated 2022-05-17 · CVE-2015-6941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salt versions 2015.5.x through 2015.5.5 Salt versions 2015.8.x through 2015.8.0

Description The issue concerns the leakage of password information in debug logs, specifically affecting the win useradd, salt-cloud, and the Linode driver components.

Recommendations For Salt versions 2015.5.x through 2015.5.5, update to version 2015.5.6 or later. For Salt versions 2015.8.x through 2015.8.0, update to version 2015.8.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-534

Related Identifiers

CVE-2015-6941

GHSA-CXM4-7QCW-267R

PYSEC-2017-71

USN-4769-1

Affected Products

Salt

Ubuntu

References · 23

• https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-6941 · Security Note
• https://ubuntu.com/security/notices/USN-4769-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxm4-7qcw-267r · Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14696 · Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-6941 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14695 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15751 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-6941 · Security Note
• https://ubuntu.com/security/CVE-2015-6918 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1273066 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6941 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4769-1 · Vendor Advisory