CVE-2015-8034
Salt uses weak permissions on the cache data
CVE-2015-8034 is a low vulnerability (CVSS 3.3) in Saltstack Salt, published July 28, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in salt 2015.8.3.
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
CVE-2015-8034- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
CVE-2015-8034- Updated
- 2026-11-02
EUVDEUVD-2017-0116 No score
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
EUVD-2017-0116- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6prw-8xhm-h247
Salt uses weak permissions on the cache data
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
GHSA-6prw-8xhm-h247- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-6prw-8xhm-h247
Salt uses weak permissions on the cache data
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
GHSA-6prw-8xhm-h247- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8034
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
UBUNTU-CVE-2015-8034- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVPYSEC-2017-32 No score
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- Record
PYSEC-2017-32- Updated
- 2026-11-02
OSVSUSE-SU-2016:1895-1 No score
Security update for salt
salt was updated to fix one security issue.
This security issue was fixed:
- CVE-2015-8034: Prevent saving state.sls cache data to disk with insecure permissions (bsc#957914).
- Record
SUSE-SU-2016:1895-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1896-1 No score
Security update for salt
salt was updated to fix one security issue.
This security issue was fixed:
- CVE-2015-8034: Prevent saving state.sls cache data to disk with insecure permissions (bsc#957914).
- Record
SUSE-SU-2016:1896-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1897-1 No score
Security update for salt
salt was updated to fix one security issue.
This security issue was fixed:
- CVE-2015-8034: Prevent saving state.sls cache data to disk with insecure permissions (bsc#957914).
- Record
SUSE-SU-2016:1897-1- Updated
- 2026-11-02
OSVUSN-8153-1 No score
salt vulnerabilities
Zach Malone discovered that Salt did not properly handle permissions to cache data. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2015-8034) Dylan Frese discovered that Salt incorrectly allowed users to specify PAM service. An attacker could possibly use this issue to bypass authentication. (CVE-2016-3176)
- Record
USN-8153-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
saltPyPI |
before 2015.8.3 | 2015.8.3 |
saltPyPI |
before 2015.8.3, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3 |
2015.8.3 |
saltSUSE:Enterprise Storage 2 |
before 2014.1.10-6.4 | 2014.1.10-6.4 |
saltSUSE:Enterprise Storage 2.1 |
before 2014.1.10-8.4 | 2014.1.10-8.4 |
saltSUSE:Enterprise Storage 1.0 |
before 2014.1.10-8.4 | 2014.1.10-8.4 |
saltUbuntu:Pro:14.04:LTS |
before 0.17.5+ds-1ubuntu0.1~esm5, plus listed versions 0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2 Show 8 moreShow less0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-10.17.5+ds-1ubuntu0.1~esm10.17.5+ds-1ubuntu0.1~esm20.17.5+ds-1ubuntu0.1~esm4 |
0.17.5+ds-1ubuntu0.1~esm5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/96390
docs.saltstack.com/en/latest/topics/releases/2015.8.3.html
nvd.nist.gov/vuln/detail/CVE-2015-8034
github.com/saltstack/salt/issues/28455
web.archive.org/web/20200227192308/http://www.securityfocus.com/bid/96390
Show 12 moreShow less
suse.com/support/update/announcement/2016/suse-su-20161895-1
bugzilla.suse.com/957914
ubuntu.com/security/CVE-2015-8034
cve.org/CVERecord?id=CVE-2015-8034
Left out here: 50 versions. The JSON record has them.