CVE-2015-1839

Description

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

How to fix CVE-2015-1839

To remediate CVE-2015-1839, upgrade the affected package to a fixed version below.

• PyPI/salt—upgrade to 2014.7.4 or later
• PyPI/salt—upgrade to b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81 or later

Is CVE-2015-1839 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2014.7.4
• from 0, < b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81, < 22d2f7a1ec93300c34e8c42d14ec39d51e610b5c | from 0, < 2014.7.4

CVSS scores

References (9)

• ADVISORYgithub.com/advisories/GHSA-6grp-75pq-c8cj
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-1839
• PATCHgithub.com/saltstack/salt
• WEBlists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html
• WEB