CVEvulnerability
CVE-2014-5247
2.1 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-08-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
Affected configurations
• spi-inc ganeti 2.10.0
• spi-inc ganeti 2.10.1
• spi-inc ganeti 2.10.2
• spi-inc ganeti 2.10.3
• spi-inc ganeti 2.10.4
• spi-inc ganeti 2.10.5
• spi-inc ganeti 2.10.6
• spi-inc ganeti 2.11.0
• spi-inc ganeti 2.11.1
• spi-inc ganeti 2.11.2
• spi-inc ganeti 2.11.3
• spi-inc ganeti 2.11.4
Related
Weakness · not in database (1)
References
- http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 git.ganeti.org
- http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html Exploit
- http://seclists.org/oss-sec/2014/q3/370 seclists.org
- http://www.ocert.org/advisories/ocert-2014-006.html US Government Resource
- http://www.securityfocus.com/archive/1/533119/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/69186 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95256 exchange.xforce.ibmcloud.com
- http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 git.ganeti.org
- http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html Exploit
- http://seclists.org/oss-sec/2014/q3/370 seclists.org
- http://www.ocert.org/advisories/ocert-2014-006.html US Government Resource
- http://www.securityfocus.com/archive/1/533119/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/69186 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95256 exchange.xforce.ibmcloud.com