VYPR
Get started
← All advisories
Medium severity5.3NVD Advisory· Published Apr 13, 2017· Updated May 13, 2026

CVE-2015-1839

CVE-2015-1839

Description

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 2014.7.42014.7.4

Affected products

2

Patches

2
22d2f7a1ec93

Use cachedir

https://github.com/saltstack/saltColton MyersMar 25, 2015via ghsa
commit
1 file changed · +4 −1
  • salt/modules/chef.py+4 −1 modified
    @@ -29,7 +29,10 @@ def _default_logfile(exe_name):
     Retrieve the logfile name
     '''
     if salt.utils.is_windows():
-        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
+        tmp_dir = os.path.join(__opts__['cachedir'], 'tmp')
+        if not os.path.isdir(tmp_dir):
+            os.mkdir(tmp_dir)
+        logfile_tmp = tempfile.NamedTemporaryFile(dir=tmp_dir,
                                                   prefix=exe_name,
                                                   suffix='.log',
                                                   delete=False)
b49d0d4b5ca5

Create randomized logfile name in windows for chef.py

https://github.com/saltstack/saltColton MyersMar 25, 2015via ghsa
commit
1 file changed · +10 −5
  • salt/modules/chef.py+10 −5 modified
    @@ -6,6 +6,7 @@
 # Import Python libs
 import logging
 import os
+import tempfile
 
 # Import Salt libs
 import salt.utils
@@ -24,12 +25,16 @@ def __virtual__():
 
 
 def _default_logfile(exe_name):
-
+    '''
+    Retrieve the logfile name
+    '''
     if salt.utils.is_windows():
-        logfile = salt.utils.path_join(
-            os.environ['TMP'],
-            '{0}.log'.format(exe_name)
-        )
+        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
+                                                  prefix=exe_name,
+                                                  suffix='.log',
+                                                  delete=False)
+        logfile = logfile_tmp.name
+        logfile_tmp.close()
     else:
         logfile = salt.utils.path_join(
             '/var/log',

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.