CVE-2015-6941 salt password information leaked in debug logs
Attackers with access to debug logs can read leaked password information from Salt's useradd, cloud, and Linode drivers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-6941?
CVE-2015-6941 is a critical vulnerability in n/a, published on 9 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
Weakness: CWE-534
Which versions are affected by CVE-2015-6941?
5 open source packages ship an affected version, including salt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 2015.5 | 2015.5.6, 2015.8.1 |
salt PyPI | From 2015.5 | 2015.5.6 |
salt PyPI | From 2015.5 | 2015.5.6 |
salt PyPI | From 2015.8 | 2015.8.1 |
salt PyPI | From 2015.8 | 2015.8.1 |
Products include Saltstack Salt 2015.
How do I fix CVE-2015-6941?
Upgrade salt to a fixed version for your release line: 2015.5.6 or 2015.8.1.
Is CVE-2015-6941 being exploited?
There is no known exploitation of CVE-2015-6941 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cxm4-7qcw-267r, PYSEC-2017-71, UBUNTU-CVE-2015-6941.