Unrated severityNVD Advisory· Published Aug 29, 2014· Updated May 6, 2026
CVE-2014-5247
CVE-2014-5247
Description
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
Affected products
18cpe:2.3:a:spi-inc:ganeti:2.10.0:*:*:*:*:*:*:*+ 17 more
- cpe:2.3:a:spi-inc:ganeti:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:spi-inc:ganeti:2.11.4:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.htmlnvdExploit
- www.ocert.org/advisories/ocert-2014-006.htmlnvdUS Government Resource
- seclists.org/oss-sec/2014/q3/370nvd
- www.securityfocus.com/archive/1/533119/100/0/threadednvd
- www.securityfocus.com/bid/69186nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/95256nvd
News mentions
0No linked articles in our index yet.