win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
Weakness
This entry has been deprecated because its abstraction was too low-level. See CWE-532.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Salt_2015 | Saltstack | 5.0 (including) | 5.0 (including) |
| Salt_2015 | Saltstack | 5.1 (including) | 5.1 (including) |
| Salt_2015 | Saltstack | 5.2 (including) | 5.2 (including) |
| Salt_2015 | Saltstack | 5.3 (including) | 5.3 (including) |
| Salt_2015 | Saltstack | 5.4 (including) | 5.4 (including) |
| Salt_2015 | Saltstack | 5.5 (including) | 5.5 (including) |
| Salt_2015 | Saltstack | 8.0 (including) | 8.0 (including) |
| Salt | Ubuntu | esm-infra-legacy/trusty | * |
| Salt | Ubuntu | trusty | * |
| Salt | Ubuntu | trusty/esm | * |
| Salt | Ubuntu | upstream | * |
| Salt | Ubuntu | vivid | * |
| Salt | Ubuntu | wily | * |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1273066
- https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html
- https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html
- https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710
- https://bugzilla.redhat.com/show_bug.cgi?id=1273066
- https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html
- https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html
- https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710