CVE-2015-8034: Weak Permissions in Salt Package Cache Data
Summary
CVE-2015-8034: The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file. Affects salt versions < 2015.8.3. Fixed in 2015.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Salt package is a popular configuration management and remote execution tool used for managing and automating the deployment of software across a network. It allows administrators to define the desired state of a system and enforce that state on multiple machines. The package includes various components such as a master server, minion agents, and a command-line interface. The vulnerability described in CVE-2015-8034 affects the state.sls function in Salt versions prior to 2015.8.3.
Vulnerability Detail
The state.sls function in Salt before version 2015.8.3 utilizes weak permissions on the cache data, which can be exploited by local users to gain unauthorized access to sensitive information. By reading the cache file, an attacker can obtain potentially confidential data stored within the Salt package. This vulnerability poses a risk to systems where multiple users have access to the affected cache file.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2015.8.3
This is the first release that contains the fix.
pip install --upgrade "salt==2015.8.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by manually adjusting the permissions on the cache data file. By setting strict permissions that limit access to the file, the vulnerability can be mitigated. However, this workaround is temporary and should be followed by an upgrade to a secure version as soon as possible. The following code snippet demonstrates how to modify the permissions:
cd /path/to/cache/directory
chmod 600 cache_file
cd -
Conclusion
In conclusion, the vulnerability (CVE-2015-8034) in the Salt package allows local users to gain unauthorized access to sensitive information by exploiting weak permissions on the cache data. To mitigate this vulnerability, it is crucial to upgrade to Salt version 2015.8.3 or later. Users can also implement a temporary workaround by adjusting the permissions on the cache file. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
The vulnerability allows local users to read sensitive information from the cache file, potentially exposing confidential data stored within the Salt package.
No, this vulnerability can only be exploited by local users who have access to the affected cache file.
There have been no reported instances of this vulnerability being actively exploited in the wild.
No, this vulnerability only affects Salt versions prior to 2015.8.3. Upgrading to version 2015.8.3 or later resolves the issue.
For more information about this vulnerability, you can refer to the official advisory provided by the Python Package Index (PyPI) advisory database. The advisory can be found at: https://github.com/pypa/advisory-database/blob/main/vulns/salt/PYSEC-2017-32.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
