{"id":"CVE-2015-1838","aliases":["EUVD-2017-0113","GHSA-92pw-mff9-jqgm","PYSEC-2017-29","UBUNTU-CVE-2015-1838"],"status":"published","title":"Salt improper handling of tmp files","description":"modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00428,"percentile":0.37278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-19"],"published":"2017-04-13T14:00:00Z","modified":"2026-06-17T00:23:05Z","fixes":[{"ecosystem":"PyPI","package":"salt","fixed_in":["2014.7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.7.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.7.4"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3"]},{"source":"osv","ecosystem":"PyPI","package":"salt","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"e11298d7155e9982749483ca5538e46090caef9c"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.7.4"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.90","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.0rc1","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.8.7","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.9.1","2014.1.0","2014.1.0rc1","2014.1.0rc2","2014.1.0rc3","2014.1.1","2014.1.10","2014.1.11","2014.1.12","2014.1.13","2014.1.2","2014.1.3","2014.1.4","2014.1.5","2014.1.6","2014.1.7","2014.1.8","2014.1.9","2014.7.0","2014.7.0rc1","2014.7.0rc2","2014.7.0rc3","2014.7.0rc4","2014.7.0rc5","2014.7.0rc6","2014.7.0rc7","2014.7.1","2014.7.2","2014.7.3","v2014.7.3","v2014.7.2","v2014.7.1","v2014.7.0","v2014.7","v2014.7.0rc7","v2014.7.0rc6","v2014.7.0rc5","v2014.7.0rc3","v2014.7.0rc4","v2014.7.0rc2","v2014.7.0rc1","v2014.1","v0.17","v0.16","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.9","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.9","v0.8.7","v0.8.0","v0.7.0","v0.6.0"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"saltstack","product":"salt"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212784","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","web","report"]},{"url":"https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","web","fix","report"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1838","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-29.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-92pw-mff9-jqgm","tags":["advisory"]},{"url":"https://github.com/saltstack/salt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-1838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1838","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1838","description":"modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.","status":"published","published":"2017-04-13T14:00:00Z","modified":"2024-08-06T04:54:16.42Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2017-0113","description":"modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.","status":"published","published":"2017-04-13T14:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:13.664628Z"}],"ghsa":[{"id":"GHSA-92pw-mff9-jqgm","title":"Salt improper handling of tmp files","description":"`modules/serverdensity_device.py` in SaltStack before 2014.7.4 does not properly handle files in `/tmp`.","status":"published","published":"2022-05-17T02:49:26Z","modified":"2024-10-21T21:47:14Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2015-1838","description":"modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.","status":"published","published":"2017-04-13T14:59:00.713Z","modified":"2026-06-17T00:23:05.567Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-19"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"GHSA-92pw-mff9-jqgm","title":"Salt improper handling of tmp files","description":"`modules/serverdensity_device.py` in SaltStack before 2014.7.4 does not properly handle files in `/tmp`.","status":"published","published":"2022-05-17T02:49:26Z","modified":"2024-12-01T05:36:08.11138Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2015-1838","description":"modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.","status":"withdrawn","published":"2017-04-13T14:59:00Z","modified":"2025-07-16T08:11:25.411422Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"PYSEC-2017-29","description":"modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.","status":"published","published":"2017-04-13T14:59:00Z","modified":"2026-06-10T17:02:48.05525999Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}