CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2015-6941
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
Severity
- EPSS
- 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-534
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saltstack:salt_2015
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cxm4-7qcw-267r | PyPI | salt | >=2015.5 <2015.5.6 | 2015.5.6 |
| GHSA-cxm4-7qcw-267r | PyPI | salt | >=2015.8 <2015.8.1 | 2015.8.1 |
| PYSEC-2017-71 | PyPI | salt | >=2015.5 <2015.5.6 >=2015.8 <2015.8.1 | 2015.5.6, 2015.8.1 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1273066
- https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html
- https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html
- https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710
- https://bugzilla.redhat.com/show_bug.cgi?id=1273066