CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1839
https://notcve.org/view.php?id=CVE-2015-1839
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. modules/chef.py en SaltStack en versiones anteriores a 2014.7.4 no maneja correctamente archivos en /tmp. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html https://bugzilla.redhat.com/show_bug.cgi?id=1212788 https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5c https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81 • CWE-19: Data Processing Errors •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9639
https://notcve.org/view.php?id=CVE-2016-9639
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. Salt en versiones anteriores a 2015.8.11 permite a minions eliminados para leer o escribir minions con el mismo id, relacionado con el almacenamiento en caché. • http://www.openwall.com/lists/oss-security/2016/11/25/2 http://www.openwall.com/lists/oss-security/2016/11/25/3 http://www.securityfocus.com/bid/94553 https://docs.saltstack.com/en/2015.8/ref/configuration/master.html#rotate-aes-key • CWE-284: Improper Access Control •
CVSS: 5.6EPSS: 0%CPEs: 8EXPL: 0CVE-2016-3176
https://notcve.org/view.php?id=CVE-2016-3176
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient. Salt en versiones anteriores a 2015.5.10 y 2015.8.x en versiones anteriores a 2015.8.8, cuando la autenticación externa de PAM está habilitada, permite a atacantes eludir el servicio de autenticación configurado pasando un servicio alternativo con un comando enviado a LocalClient. • https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html • CWE-287: Improper Authentication •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8034
https://notcve.org/view.php?id=CVE-2015-8034
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file. La función state.sls en Salt en versiones anteriores a 2015.8.3 utiliza permisos débiles en los datos de caché, lo que permite a los usuarios locales obtener información sensible leyendo el archivo. • http://www.securityfocus.com/bid/96390 https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2016-1866
https://notcve.org/view.php?id=CVE-2016-1866
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream. Salt 2015.8.x en versiones anteriores a 2015.8.4 no maneja correctamente mensajes en claro en el minion, lo que permite a atacantes man-in-the-middle ejecutar código arbitrario insertando paquetes en el flujo de datos del minion-master. • http://lists.opensuse.org/opensuse-updates/2016-03/msg00034.html https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html • CWE-284: Improper Access Control •