GitHub Advisoryadvisory · PyPI
GHSA-6prw-8xhm-h247 Salt uses weak permissions on the cache data
LOW
Official page ↗
- Aliases
- CVE-2015-8034
- Ecosystem
- PyPI
- Packages
- salt
- Severity
- Low
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2024-04-29
Affected packages
• PyPI salt: < 2015.8.3 → fixed in 2015.8.3
Description
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
Related
Alias · CVE (1)
- CVE-2015-8034 The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-8034 advisory
- https://github.com/saltstack/salt/issues/28455 web
- https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html web
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-32.yaml web
- https://github.com/saltstack/salt package
- https://web.archive.org/web/20200227192308/http://www.securityfocus.com/bid/96390 web