CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

Design/Logic Flaw

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1839

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

PYSEC-2017-29

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

UBUNTU-CVE-2015-1838

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

PYSEC-2017-30

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1838

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1839

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

PYSEC-2017-29

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

Code injection

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

UBUNTU-CVE-2015-1839

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

PYSEC-2017-30

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1838

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1839

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1839

CVE-2015-1839 affects SaltStack (Salt) due to insecure handling of files in /tmp in the module salt/modules/chef.py, specifically in versions before 2014.7.4. The vulnerability stems from improper /tmp handling, allowing an attacker to alter a specified file (per CNVD entry) and is documented acr...

CVE-2015-1838

Removed by vendor...

CVE-2015-1839

Removed by vendor...

CVE-2015-1838

modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

CVE-2015-1838

The CVE-2015-1838 entry concerns SaltStack, specifically modules/serverdensity_device.py, with the flaw existing in SaltStack prior to version 2014.7.4 due to improper handling of files in /tmp. The vulnerability is documented in multiple feeds, including NVD (CVE-2015-1838) indicating a local, l...

CVE-2017-5192

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Mitigation Disable salt-api for mitigation...