CVE-2014-3563 json
SaltStack Salt Insecure Temporary File Creation
published 2014-08-22 12 y ago modified 2026-06-17 4 mo ago also GHSA-mfr3-9cj8-h2qm , PYSEC-2014-18 , EUVD-2014-0103
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Patch / fix
- pypi salt 2014.1.10
- salt Ubuntu Pro 14.04 LTS 0.17.5+ds-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2014-3563
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | salt | <2014.1.10 |
2014.1.10 |
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
seclists.org
/oss-sec/2014/q3/428
mailing-list, web, patch
-
docs.saltstack.com
/en/latest/topics/releases/2014.1.10.html
web, patch, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/95392
vdb-entry, web
-
securityfocus.com
/bid/69319
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2014-3563
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2014-18.yaml
web
-
github.com
/saltstack/salt
package
-
github.com
/advisories/GHSA-mfr3-9cj8-h2qm
advisory
Sources
- CVE List CVE-2014-3563
- GitHub Advisory GHSA-mfr3-9cj8-h2qm
- NVD CVE-2014-3563
- OSV PYSEC-2014-18
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.