Back Linuxsecurity

Ubuntu 14.04 LTS Salt Critical Info Disclosure Auth Bypass USN-8153

Linuxsecurity •LinuxSecurity Advisories • April 7, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Salt. Software Description: - salt: Infrastructure management built on a dynamic communication bus Details: Zach Malone discovered that Salt did not properly handle permissions to cache data. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2015-8034) Dylan Frese discovered that Salt incorrectly allowed users to specify PAM service. An attacker could possibly use this issue to bypass authentication. (CVE-2016-3176)

The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS salt-common 0.17.5+ds-1ubuntu0.1~esm5 Available with Ubuntu Pro salt-master 0.17.5+ds-1ubuntu0.1~esm5 Available with Ubuntu Pro salt-minion 0.17.5+ds-1ubuntu0.1~esm5 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2015-8034, CVE-2016-3176

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Salt Vulnerabilities in Ubuntu 14.04 LTS Exposed On April 7, 2026, Ubuntu announced critical vulnerabilities in the Salt infrastructure management tool affecting Ubuntu 14.04 LTS. Discovered by Zach Malone and Dylan Frese, these vulnerabilities include improper permission handling for cached data (CVE-2015-8034), allowing local attackers to access sensitive information, and an authentication bypass through PAM service misconfiguration (CVE-2016-3176). The vulnerabilities could lead to significant security breaches if exploited. Users are advised to update their systems to the latest package versions to mitigate these risks. The affected packages include salt-common, salt-master, and salt-minion, all requiring updates available through Ubuntu Pro. The vulnerabilities were published in 2017, but their exploitation potential remains relevant today. A standard system update is recommended to address these issues. 2 sources 58

Extracted Entities

Ubuntu 14.04 LTS Salt Critical Info Disclosure Auth Bypass USN-8153

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Platforms (3)

Tools (1)