Lucene search

K
freebsdFreeBSDE6B974AB-9D35-11E5-8F5C-002590263BF5
HistoryNov 25, 2015 - 12:00 a.m.

Salt -- information disclosure

2015-11-2500:00:00
vuxml.freebsd.org
15

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0

Percentile

5.1%

Salt release notes report:

CVE-2015-8034: Saving state.sls cache data to disk with insecure
permissions
This affects users of the state.sls function. The state run cache
on the minion was being created with incorrect permissions. This
file could potentially contain sensitive data that was inserted via
jinja into the state SLS files. The permissions for this file are
now being set correctly. Thanks to @zmalone for bringing this issue
to our attention.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpy27-salt< 2015.8.3UNKNOWN

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0

Percentile

5.1%