Description
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | salt | 0.17.5+ds-1ubuntu0.1~esm5 | USN-8153-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 2.1 | salt | 2014.1.10-8.4 | SUSE-SU-2016:1896-1 |
| SUSE Enterprise Storage 2 | salt | 2014.1.10-6.4 | SUSE-SU-2016:1895-1 |
| SUSE Enterprise Storage 1.0 | salt | 2014.1.10-8.4 | SUSE-SU-2016:1897-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | < 2015.8.3 | 2015.8.3 | GHSA-6prw-8xhm-h247 |
Advisories 4
- USN-8153-1 salt vulnerabilities Ubuntu Security Notices (USN) · Apr 8, 2026
- SUSE-SU-2016:1895-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1896-1 Security update for salt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1897-1 Security update for salt SUSE / openSUSE Security Updates · May 2, 2025