Vulnerability Details : CVE-2015-7944
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
Vulnerability category: Denial of service
Products affected by CVE-2015-7944
- cpe:2.3:a:spi-inc:ganeti:*:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.7:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7944
4.55%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-7944
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2015-7944
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7944
-
http://www.ocert.org/advisories/ocert-2015-012.html
oCERT archivePatch;Third Party Advisory;VDB Entry
-
http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2
News — Ganeti 2.14.2 documentationRelease Notes;Vendor Advisory
-
https://www.exploit-db.com/exploits/39169/
Ganeti - Multiple Vulnerabilities
-
http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8
News — Ganeti 2.10.8 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7
News — Ganeti 2.9.7 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3
News — Ganeti 2.13.3 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2
News — Ganeti 2.15.2 documentationRelease Notes;Vendor Advisory
-
http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html
Ganeti Leaked Secret / Denial Of Service ≈ Packet StormPatch;Third Party Advisory;VDB Entry
-
http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8
News — Ganeti 2.11.8 documentationRelease Notes;Vendor Advisory
-
http://www.debian.org/security/2016/dsa-3431
Debian -- Security Information -- DSA-3431-1 ganeti
-
http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6
News — Ganeti 2.12.6 documentationRelease Notes;Vendor Advisory
Jump to