CVE-2015-1839

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-19

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1212788Issue Tracking, Patch
https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.htmlRelease Notes, Vendor Advisory
https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5cIssue Tracking, Patch, Third Party Advisory
https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81Issue Tracking, Patch, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1212788Issue Tracking, Patch
https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.htmlRelease Notes, Vendor Advisory
https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5cIssue Tracking, Patch, Third Party Advisory
https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-18405.0jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and CVE-2015-18413.7The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting CVE-2015-184210.0The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd dae CVE-2015-18434.3The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the regist CVE-2015-18444.0Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.CVE-2015-184510.0Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2015-18467.8unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrA CVE-2015-18477.5Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally i CVE-2015-18486.8The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for re CVE-2015-18495.9AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information CVE-2015-18516.8OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticate CVE-2015-18524.3The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verificat