PT-2017-7094

CVE-2015-6941

Published

2017-08-09

Updated

2022-05-17

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salt versions 2015.5.x through 2015.5.5 Salt versions 2015.8.x through 2015.8.0

Description The issue concerns the leakage of password information in debug logs, specifically affecting the win useradd, salt-cloud, and the Linode driver components.

Recommendations For Salt versions 2015.5.x through 2015.5.5, update to version 2015.5.6 or later. For Salt versions 2015.8.x through 2015.8.0, update to version 2015.8.1 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-534: DEPRECATED: Information Exposure Through Debug Log Files

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2015-6941

GHSA-CXM4-7QCW-267R