CVE-2015-1838

Description

modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

How to fix CVE-2015-1838

To remediate CVE-2015-1838, upgrade the affected package to a fixed version below.

• PyPI/salt—upgrade to 2014.7.4 or later
• PyPI/salt—upgrade to e11298d7155e9982749483ca5538e46090caef9c or later

Is CVE-2015-1838 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2014.7.4
• from 0, < e11298d7155e9982749483ca5538e46090caef9c | from 0, < 2014.7.4

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-92pw-mff9-jqgm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-1838
• PATCHgithub.com/saltstack/salt
• WEBlists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html
• WEB