CVE-2015-6941: DEPRECATED: Information Exposure Through Debug Log Files (CWE-534)
value: win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
CWE description: This entry has been deprecated because its abstraction was too low-level.  See CWE-532.
CVSS v3 base score: 9.8
Published: 2017-08-09T16:29Z
Repository: https://github.com/twangboy/salt
Language: Python
Files changed: salt/states/user.py
Commit date: 2015-09-11 16:48:21 -0600
Commit message: Replaced password with redacted when displayed

Diff: diff --git a/salt/states/user.py b/salt/states/user.py
index 1f269b3aa..b31ec0c69 100644
--- a/salt/states/user.py
+++ b/salt/states/user.py
@@ -365,10 +365,12 @@ def present(name,
         if __opts__['test']:
             ret['result'] = None
             ret['comment'] = ('The following user attributes are set to be '
                               'changed:\n')
             for key, val in changes.items():
+                if key == 'password':
+                    val = 'XXX-REDACTED-XXX'
                 ret['comment'] += '{0}: {1}\n'.format(key, val)
             return ret
         # The user is present
         if 'shadow.info' in __salt__:
             lshad = __salt__['shadow.info'](name)
@@ -486,13 +488,13 @@ def present(name,
                     __salt__['shadow.set_password'](name, password)
                     spost = __salt__['shadow.info'](name)
                     if spost['passwd'] != password:
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['password'] = password
+                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                 if date:
                     __salt__['shadow.set_date'](name, date)
                     spost = __salt__['shadow.info'](name)
                     if spost['lstchg'] != date:
                         ret['comment'] = 'User {0} created but failed to set' \
@@ -548,13 +550,13 @@ def present(name,
             elif salt.utils.is_windows():
                 if password and not empty_password:
                     if not __salt__['user.setpassword'](name, password):
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['passwd'] = password
+                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'
         else:
             ret['comment'] = 'Failed to create new user {0}'.format(name)
             ret['result'] = False
 
     return ret

Vulnerable code:                                          ' {1}'.format(name, password)
                    ret['changes']['password'] = password
                                         ' {1}'.format(name, password)
                    ret['changes']['passwd'] = password
Fixed code:                 if key == 'password':
                    val = 'XXX-REDACTED-XXX'
                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'