CVE-2015-8945 - Vulnerability Details - OpenCVE

openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00136.

Key SSVC decision points have not yet been added.

Vendors	Products
Openshift	Origin

Configuration 1 [-]

cpe:2.3:a:openshift:origin:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2015-8801	openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2016/07/13/10
http://www.openwall.com/lists/oss-security/2016/07/13/9
http://www.securityfocus.com/bid/91776
https://github.com/openshift/origin/issues/3951
https://nvd.nist.gov/vuln/detail/CVE-2015-8945
https://www.cve.org/CVERecord?id=CVE-2015-8945

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-08-05T15:00:00

Updated: 2024-08-06T08:36:31.445Z

Reserved: 2016-07-13T00:00:00

Link: CVE-2015-8945

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-08-05T15:59:00.130

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-8945

Redhat

Severity : Moderate

Publid Date: 2015-07-29T00:00:00Z

Links: CVE-2015-8945 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-07-29T00:00:00", "descriptions": [{"lang": "en", "value": "openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-08-05T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20160713 CVE Request: openshift-node is logging private RSA keys to the systemd journal", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/9"}, {"name": "91776", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/91776"}, {"name": "[oss-security] 20160713 Re: CVE Request: openshift-node is logging private RSA keys to the systemd journal", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/10"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openshift/origin/issues/3951"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-8945", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20160713 CVE Request: openshift-node is logging private RSA keys to the systemd journal", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/07/13/9"}, {"name": "91776", "refsource": "BID", "url": "http://www.securityfocus.com/bid/91776"}, {"name": "[oss-security] 20160713 Re: CVE Request: openshift-node is logging private RSA keys to the systemd journal", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/07/13/10"}, {"name": "https://github.com/openshift/origin/issues/3951", "refsource": "CONFIRM", "url": "https://github.com/openshift/origin/issues/3951"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:36:31.445Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20160713 CVE Request: openshift-node is logging private RSA keys to the systemd journal", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/9"}, {"name": "91776", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/91776"}, {"name": "[oss-security] 20160713 Re: CVE Request: openshift-node is logging private RSA keys to the systemd journal", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/10"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/openshift/origin/issues/3951"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8945", "datePublished": "2016-08-05T15:00:00", "dateReserved": "2016-07-13T00:00:00", "dateUpdated": "2024-08-06T08:36:31.445Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openshift:origin:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1DEBE0A-A7EF-4DE6-AA96-6AF8A266DD35", "versionEndIncluding": "1.1.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal."}, {"lang": "es", "value": "openshift-node en OpenShift Origin 1.1.6 y versiones anteriores almacena incorrectamente credenciales de router como envvars en la ranura cuando la opci\u00f3n --credentials es usada, lo que permite a usuarios locales obtener informaci\u00f3n clave privada y sensible leyendo el diario systemd."}], "id": "CVE-2015-8945", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.4, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-08-05T15:59:00.130", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "VDB Entry"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/10"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "VDB Entry"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/9"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/91776"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/openshift/origin/issues/3951"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "VDB Entry"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "VDB Entry"], "url": "http://www.openwall.com/lists/oss-security/2016/07/13/9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/91776"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/openshift/origin/issues/3951"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}