Published: 29/08/2014 Updated: 07/11/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 prior to 2.10.7 and 2.11.0 prior to 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.

Vulnerable Product	Search on Vulmon	Subscribe to Product
spi-inc ganeti 2.10.4
spi-inc ganeti 2.10.3
spi-inc ganeti 2.10.2
spi-inc ganeti 2.10.1
spi-inc ganeti 2.10.6
spi-inc ganeti 2.10.5
spi-inc ganeti 2.10.0
spi-inc ganeti 2.11.4
spi-inc ganeti 2.11.3
spi-inc ganeti 2.11.0
spi-inc ganeti 2.11.2
spi-inc ganeti 2.11.1

CWE-264 http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html http://www.securityfocus.com/bid/69186 http://seclists.org/oss-sec/2014/q3/370 http://www.ocert.org/advisories/ocert-2014-006.html https://exchange.xforce.ibmcloud.com/vulnerabilities/95256 http://www.securityfocus.com/archive/1/533119/100/0/threaded http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-5247

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect