Vulnerability Details : CVE-2015-7945
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Vulnerability category: Information leak
Products affected by CVE-2015-7945
- cpe:2.3:a:spi-inc:ganeti:*:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.13.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.12.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.7:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7945
0.48%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-7945
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2015-7945
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7945
-
http://www.ocert.org/advisories/ocert-2015-012.html
oCERT archivePatch;Third Party Advisory;VDB Entry
-
http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2
News — Ganeti 2.14.2 documentationRelease Notes;Vendor Advisory
-
https://www.exploit-db.com/exploits/39169/
Ganeti - Multiple Vulnerabilities
-
http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8
News — Ganeti 2.10.8 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7
News — Ganeti 2.9.7 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3
News — Ganeti 2.13.3 documentationRelease Notes;Vendor Advisory
-
http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2
News — Ganeti 2.15.2 documentationRelease Notes;Vendor Advisory
-
http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html
Ganeti Leaked Secret / Denial Of Service ≈ Packet StormPatch;Third Party Advisory;VDB Entry
-
http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8
News — Ganeti 2.11.8 documentationRelease Notes;Vendor Advisory
-
http://www.debian.org/security/2016/dsa-3431
Debian -- Security Information -- DSA-3431-1 ganeti
-
http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6
News — Ganeti 2.12.6 documentationRelease Notes;Vendor Advisory
Jump to