The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2014-08-29T17:00:00
Updated: 2024-08-06T11:41:48.270Z
Reserved: 2014-08-14T00:00:00
Link: CVE-2014-5247
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-08-29T16:55:12.030
Modified: 2023-11-07T02:20:47.390
Link: CVE-2014-5247
Redhat
No data.