Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by spi-inc
CVE-2015-7945 (GCVE-0-2015-7945)
Vulnerability from nvd – Published: 2017-08-18 17:00 – Updated: 2024-08-06 08:06
VLAI
EPSS
VEX
Summary
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| http://docs.ganeti.org/ganeti/2.11/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.12/html/news.html… | x_refsource_CONFIRM |
| http://www.debian.org/security/2016/dsa-3431 | vendor-advisoryx_refsource_DEBIAN |
| http://docs.ganeti.org/ganeti/2.13/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.15/html/news.html… | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/135101/Ganet… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/39169/ | exploitx_refsource_EXPLOIT-DB |
| http://docs.ganeti.org/ganeti/2.9/html/news.html#… | x_refsource_CONFIRM |
| http://www.ocert.org/advisories/ocert-2015-012.html | x_refsource_MISC |
| http://docs.ganeti.org/ganeti/2.10/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.14/html/news.html… | x_refsource_CONFIRM |
Date Public
2015-12-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:06:31.127Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7945",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"name": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"name": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"name": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"name": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"name": "http://www.ocert.org/advisories/ocert-2015-012.html",
"refsource": "MISC",
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"name": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7945",
"datePublished": "2017-08-18T17:00:00.000Z",
"dateReserved": "2015-10-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:06:31.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-7944 (GCVE-0-2015-7944)
Vulnerability from nvd – Published: 2017-08-18 17:00 – Updated: 2024-08-06 08:06
VLAI
EPSS
VEX
Summary
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| http://docs.ganeti.org/ganeti/2.11/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.12/html/news.html… | x_refsource_CONFIRM |
| http://www.debian.org/security/2016/dsa-3431 | vendor-advisoryx_refsource_DEBIAN |
| http://docs.ganeti.org/ganeti/2.13/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.15/html/news.html… | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/135101/Ganet… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/39169/ | exploitx_refsource_EXPLOIT-DB |
| http://docs.ganeti.org/ganeti/2.9/html/news.html#… | x_refsource_CONFIRM |
| http://www.ocert.org/advisories/ocert-2015-012.html | x_refsource_MISC |
| http://docs.ganeti.org/ganeti/2.10/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.14/html/news.html… | x_refsource_CONFIRM |
Date Public
2015-12-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:06:31.017Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7944",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"name": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"name": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"name": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"name": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"name": "http://www.ocert.org/advisories/ocert-2015-012.html",
"refsource": "MISC",
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"name": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7944",
"datePublished": "2017-08-18T17:00:00.000Z",
"dateReserved": "2015-10-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:06:31.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5247 (GCVE-0-2014-5247)
Vulnerability from nvd – Published: 2014-08-29 17:00 – Updated: 2024-08-06 11:41
VLAI
EPSS
VEX
Summary
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3B… | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://packetstormsecurity.com/files/127851/Ganet… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/533119/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/69186 | vdb-entryx_refsource_BID |
| http://seclists.org/oss-sec/2014/q3/370 | mailing-listx_refsource_MLIST |
| http://www.ocert.org/advisories/ocert-2014-006.html | x_refsource_MISC |
Date Public
2014-08-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:41:48.270Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0"
},
{
"name": "ganeti-gntcluster-info-disc(95256)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95256"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html"
},
{
"name": "20140812 [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/533119/100/0/threaded"
},
{
"name": "69186",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69186"
},
{
"name": "[oss-security] 20140814 Re: [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/370"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ocert.org/advisories/ocert-2014-006.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0"
},
{
"name": "ganeti-gntcluster-info-disc(95256)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95256"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html"
},
{
"name": "20140812 [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/533119/100/0/threaded"
},
{
"name": "69186",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69186"
},
{
"name": "[oss-security] 20140814 Re: [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/370"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ocert.org/advisories/ocert-2014-006.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5247",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://git.ganeti.org/?p=ganeti.git;a=commit;h=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0",
"refsource": "CONFIRM",
"url": "http://git.ganeti.org/?p=ganeti.git;a=commit;h=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0"
},
{
"name": "ganeti-gntcluster-info-disc(95256)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95256"
},
{
"name": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html"
},
{
"name": "20140812 [oCERT-2014-006] Ganeti insecure archive permission",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/533119/100/0/threaded"
},
{
"name": "69186",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69186"
},
{
"name": "[oss-security] 20140814 Re: [oCERT-2014-006] Ganeti insecure archive permission",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/370"
},
{
"name": "http://www.ocert.org/advisories/ocert-2014-006.html",
"refsource": "MISC",
"url": "http://www.ocert.org/advisories/ocert-2014-006.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5247",
"datePublished": "2014-08-29T17:00:00.000Z",
"dateReserved": "2014-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T11:41:48.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-7944 (GCVE-0-2015-7944)
Vulnerability from cvelistv5 – Published: 2017-08-18 17:00 – Updated: 2024-08-06 08:06
VLAI
EPSS
VEX
Summary
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| http://docs.ganeti.org/ganeti/2.11/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.12/html/news.html… | x_refsource_CONFIRM |
| http://www.debian.org/security/2016/dsa-3431 | vendor-advisoryx_refsource_DEBIAN |
| http://docs.ganeti.org/ganeti/2.13/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.15/html/news.html… | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/135101/Ganet… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/39169/ | exploitx_refsource_EXPLOIT-DB |
| http://docs.ganeti.org/ganeti/2.9/html/news.html#… | x_refsource_CONFIRM |
| http://www.ocert.org/advisories/ocert-2015-012.html | x_refsource_MISC |
| http://docs.ganeti.org/ganeti/2.10/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.14/html/news.html… | x_refsource_CONFIRM |
Date Public
2015-12-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:06:31.017Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7944",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"name": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"name": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"name": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"name": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"name": "http://www.ocert.org/advisories/ocert-2015-012.html",
"refsource": "MISC",
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"name": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7944",
"datePublished": "2017-08-18T17:00:00.000Z",
"dateReserved": "2015-10-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:06:31.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-7945 (GCVE-0-2015-7945)
Vulnerability from cvelistv5 – Published: 2017-08-18 17:00 – Updated: 2024-08-06 08:06
VLAI
EPSS
VEX
Summary
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| http://docs.ganeti.org/ganeti/2.11/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.12/html/news.html… | x_refsource_CONFIRM |
| http://www.debian.org/security/2016/dsa-3431 | vendor-advisoryx_refsource_DEBIAN |
| http://docs.ganeti.org/ganeti/2.13/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.15/html/news.html… | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/135101/Ganet… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/39169/ | exploitx_refsource_EXPLOIT-DB |
| http://docs.ganeti.org/ganeti/2.9/html/news.html#… | x_refsource_CONFIRM |
| http://www.ocert.org/advisories/ocert-2015-012.html | x_refsource_MISC |
| http://docs.ganeti.org/ganeti/2.10/html/news.html… | x_refsource_CONFIRM |
| http://docs.ganeti.org/ganeti/2.14/html/news.html… | x_refsource_CONFIRM |
Date Public
2015-12-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:06:31.127Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7945",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6"
},
{
"name": "DSA-3431",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3431"
},
{
"name": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3"
},
{
"name": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2"
},
{
"name": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html"
},
{
"name": "39169",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39169/"
},
{
"name": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7"
},
{
"name": "http://www.ocert.org/advisories/ocert-2015-012.html",
"refsource": "MISC",
"url": "http://www.ocert.org/advisories/ocert-2015-012.html"
},
{
"name": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8"
},
{
"name": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2",
"refsource": "CONFIRM",
"url": "http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7945",
"datePublished": "2017-08-18T17:00:00.000Z",
"dateReserved": "2015-10-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:06:31.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5247 (GCVE-0-2014-5247)
Vulnerability from cvelistv5 – Published: 2014-08-29 17:00 – Updated: 2024-08-06 11:41
VLAI
EPSS
VEX
Summary
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3B… | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://packetstormsecurity.com/files/127851/Ganet… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/533119/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/69186 | vdb-entryx_refsource_BID |
| http://seclists.org/oss-sec/2014/q3/370 | mailing-listx_refsource_MLIST |
| http://www.ocert.org/advisories/ocert-2014-006.html | x_refsource_MISC |
Date Public
2014-08-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:41:48.270Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0"
},
{
"name": "ganeti-gntcluster-info-disc(95256)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95256"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html"
},
{
"name": "20140812 [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/533119/100/0/threaded"
},
{
"name": "69186",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69186"
},
{
"name": "[oss-security] 20140814 Re: [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/370"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ocert.org/advisories/ocert-2014-006.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0"
},
{
"name": "ganeti-gntcluster-info-disc(95256)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95256"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html"
},
{
"name": "20140812 [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/533119/100/0/threaded"
},
{
"name": "69186",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69186"
},
{
"name": "[oss-security] 20140814 Re: [oCERT-2014-006] Ganeti insecure archive permission",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/370"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ocert.org/advisories/ocert-2014-006.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5247",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://git.ganeti.org/?p=ganeti.git;a=commit;h=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0",
"refsource": "CONFIRM",
"url": "http://git.ganeti.org/?p=ganeti.git;a=commit;h=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0"
},
{
"name": "ganeti-gntcluster-info-disc(95256)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95256"
},
{
"name": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html"
},
{
"name": "20140812 [oCERT-2014-006] Ganeti insecure archive permission",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/533119/100/0/threaded"
},
{
"name": "69186",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69186"
},
{
"name": "[oss-security] 20140814 Re: [oCERT-2014-006] Ganeti insecure archive permission",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/370"
},
{
"name": "http://www.ocert.org/advisories/ocert-2014-006.html",
"refsource": "MISC",
"url": "http://www.ocert.org/advisories/ocert-2014-006.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5247",
"datePublished": "2014-08-29T17:00:00.000Z",
"dateReserved": "2014-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T11:41:48.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}