SaltStack has insecure /tmp file handling in salt/modules/chef.py

MEDIUM 5.3CVE-2015-1839 · GHSA-6grp-75pq-c8cj · PYSEC-2017-30 · Published 13/04/2017 · updated 17/06/2026

In short

CVE-2015-1839 is a MEDIUM (CVSS 5.3) vulnerability affecting salt, salt (saltstack).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.2% of all vulnerabilities.
Fix: update to 2014.7.4 or later.

Package	Affected versions	Patched versions
salt PyPI	`< 2014.7.4`	`2014.7.4`
salt saltstack	`≤ 2014.7.3`	No fix yet

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

NVD description

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 2014.7.4

2014.7.4

≤ 2014.7.3

No fix yet

More vulnerabilities in salt

See all →