Skip to content
OpenAdvisories
Medium USN-8153-1 2 CVEs

salt vulnerabilities

Published Apr 7, 2026 · Updated Apr 8, 2026

Ecosystem: Ubuntu

Summary

Zach Malone discovered that Salt did not properly handle permissions to cache
data. A local attacker could possibly use this issue to obtain sensitive
information. (CVE-2015-8034)
Dylan Frese discovered that Salt incorrectly allowed users to specify PAM
service. An attacker could possibly use this issue to bypass authentication.
(CVE-2016-3176)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS salt 0.17.5+ds-1ubuntu0.1~esm5

Vulnerabilities 2

  • Medium 5.6
    CVE-2016-3176

    Salt Insecure configuration of PAM external authentication service

    Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

    salt salt Ubuntu PyPI
  • Low 3.3
    CVE-2015-8034

    Salt uses weak permissions on the cache data

    The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.

    salt salt Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2015-8034
  • report
    https://ubuntu.com/security/CVE-2016-3176