Critical severity9.8NVD Advisory· Published Aug 9, 2017· Updated May 13, 2026

CVE-2015-6941

Description

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
saltPyPI	>= 2015.5, < 2015.5.6	2015.5.6
saltPyPI	>= 2015.8, < 2015.8.1	2015.8.1

Patches

c0689e32154c

Replaced password with redacted when displayed

https://github.com/saltstack/salttwangboySep 11, 2015via ghsa

commit

1 file changed · +6 −4

salt/states/user.py+6 −4 modified

@@ -367,6 +367,8 @@ def present(name,
             ret['comment'] = ('The following user attributes are set to be '
                               'changed:\n')
             for key, val in changes.items():
+                if key == 'password':
+                    val = 'XXX-REDACTED-XXX'
                 ret['comment'] += '{0}: {1}\n'.format(key, val)
             return ret
         # The user is present
@@ -488,9 +490,9 @@ def present(name,
                     if spost['passwd'] != password:
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['password'] = password
+                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                 if date:
                     __salt__['shadow.set_date'](name, date)
                     spost = __salt__['shadow.info'](name)
@@ -550,9 +552,9 @@ def present(name,
                     if not __salt__['user.setpassword'](name, password):
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['passwd'] = password
+                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'
         else:
             ret['comment'] = 'Failed to create new user {0}'.format(name)
             ret['result'] = False

c0689e32154c

Replaced password with redacted when displayed

https://github.com/twangboy/salttwangboySep 11, 2015via ghsa

commit

1 file changed · +6 −4

salt/states/user.py+6 −4 modified

@@ -367,6 +367,8 @@ def present(name,
             ret['comment'] = ('The following user attributes are set to be '
                               'changed:\n')
             for key, val in changes.items():
+                if key == 'password':
+                    val = 'XXX-REDACTED-XXX'
                 ret['comment'] += '{0}: {1}\n'.format(key, val)
             return ret
         # The user is present
@@ -488,9 +490,9 @@ def present(name,
                     if spost['passwd'] != password:
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['password'] = password
+                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                 if date:
                     __salt__['shadow.set_date'](name, date)
                     spost = __salt__['shadow.info'](name)
@@ -550,9 +552,9 @@ def present(name,
                     if not __salt__['user.setpassword'](name, password):
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['passwd'] = password
+                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'
         else:
             ret['comment'] = 'Failed to create new user {0}'.format(name)
             ret['result'] = False

fdd353745626

Replaced password with redacted when displayed

https://github.com/saltstack/salttwangboySep 11, 2015via ghsa

commit

1 file changed · +6 −4

salt/states/user.py+6 −4 modified

@@ -380,6 +380,8 @@ def present(name,
             ret['comment'] = ('The following user attributes are set to be '
                               'changed:\n')
             for key, val in changes.items():
+                if key == 'password':
+                    val = 'XXX-REDACTED-XXX'
                 ret['comment'] += '{0}: {1}\n'.format(key, val)
             return ret
         # The user is present
@@ -510,9 +512,9 @@ def present(name,
                     if spost['passwd'] != password:
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['password'] = password
+                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                 if date:
                     __salt__['shadow.set_date'](name, date)
                     spost = __salt__['shadow.info'](name)
@@ -572,9 +574,9 @@ def present(name,
                     if not __salt__['user.setpassword'](name, password):
                         ret['comment'] = 'User {0} created but failed to set' \
                                          ' password to' \
-                                         ' {1}'.format(name, password)
+                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                         ret['result'] = False
-                    ret['changes']['passwd'] = password
+                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'
         else:
             ret['comment'] = 'Failed to create new user {0}'.format(name)
             ret['result'] = False

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryVDB EntryWEB
github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710nvdPatchThird Party AdvisoryWEB
docs.saltstack.com/en/latest/topics/releases/2015.5.6.htmlnvdRelease NotesVendor AdvisoryWEB
docs.saltstack.com/en/latest/topics/releases/2015.8.1.htmlnvdRelease NotesVendor AdvisoryWEB
github.com/advisories/GHSA-cxm4-7qcw-267rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2015-6941ghsaADVISORY
github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-71.yamlghsaWEB
github.com/saltstack/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710ghsaWEB
github.com/saltstack/salt/commit/fdd35374562658f4a20767a3703fab93d92f9ca9ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000