CVE-2015-6941 (published 2017-08-09T16:29Z)

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-534
cwe_name: DEPRECATED: Information Exposure Through Debug Log Files
description: This entry has been deprecated because its abstraction was too low-level.  See CWE-532.
extended_description: 
            Prohibited
            This CWE has been deprecated.
            See description and name for possible suggestions of other CWEs to consider.
            
               
            
         
         

Fix information:
repo_url: https://github.com/twangboy/salt
commit_details: repo_url: https://github.com/twangboy/salt
author: twangboy
author_date: 2015-09-11 16:48:21-06:00
msg: Replaced password with redacted when displayed
repository: repo_url: https://github.com/twangboy/salt
repo_name: twangboy/salt
description: Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt Open software package repository here: 
repo_language: Python
owner: twangboy
file_changes: filename: user.py
change_type: ModificationType.MODIFY
diff: @@ -367,6 +367,8 @@ def present(name,
             ret['comment'] = ('The following user attributes are set to be '
                               'changed:\n')
             for key, val in changes.items():
+                if key == 'password':
+                    val = 'XXX-REDACTED-XXX'
                 ret['comment'] += '{0}: {1}\n'.format(key, val)
             return ret
         # The user is present
@@ -488,9 +490,9 @@ def present(name,
                     if spost['passwd'] != password:
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['password'] = password
+                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                 if date:
                     __salt__['shadow.set_date'](name, date)
                     spost = __salt__['shadow.info'](name)
@@ -550,9 +552,9 @@ def present(name,
                     if not __salt__['user.setpassword'](name, password):
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['passwd'] = password
+                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'
         else:
             ret['comment'] = 'Failed to create new user {0}'.format(name)
             ret['result'] = False

programming_language: Python