A vulnerability in winuseradd, salt-cloud and Linode driver were found:

winuseradd returned data including the password of the newly created user salt-cloud debug output contained winpassword and sudopassword authentication credentials Linode driver displayed authentication credentials in debug logs

Upstream patch:

https://github.com/twangboy/salt/commit/c0689e32154c41f59840ae10ffc5fbfa30618710

External reference:

https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html

It was found that calling git.clone with https user/pass will leak the authentication details to the log.

Upstream patch:

https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a