PT-2017-7315 · Saltstack+2 · Salt+2

Published 2016-02-29 · Updated 2026-04-07 · CVE-2015-8034

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.8.3

Description The issue concerns the state.sls function in Salt, which uses weak permissions on the cache data. This allows local users to obtain sensitive information by reading the file.

Recommendations For versions prior to 2015.8.3, update to version 2015.8.3 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2016-1175

CVE-2015-8034

GHSA-6PRW-8XHM-H247

PYSEC-2017-32

SUSE-SU-2016:1895-1

SUSE-SU-2016:1896-1

SUSE-SU-2016:1897-1

USN-8153-1

Affected Products

Alt Linux

Salt

Ubuntu

References · 24

• https://cve.org/CVERecord?id=CVE-2015-8034 · Security Note
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6prw-8xhm-h247 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8153-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8034 · Security Note
• https://ubuntu.com/security/notices/USN-8153-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-32 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3176 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8034 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1895-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1896-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1897-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8034 · Vendor Advisory
• https://github.com/saltstack/salt · Note
• https://github.com/saltstack/salt/issues/28455 · Note