PT-2017-7301 · Google · Ganeti

Pierre Kim + 1 · Publicado 2016-01-01 · Atualizado 2021-09-08 · CVE-2015-7944

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ganeti versions prior to 2.9.7 Ganeti versions 2.10.x prior to 2.10.8 Ganeti versions 2.11.x prior to 2.11.8 Ganeti versions 2.12.x prior to 2.12.6 Ganeti versions 2.13.x prior to 2.13.3 Ganeti versions 2.14.x prior to 2.14.2 Ganeti versions 2.15.x prior to 2.15.2

Description The issue affects the RESTful control interface, also known as RAPI or ganeti-rapi, in Ganeti when used in SSL mode. It allows remote attackers to cause a denial of service by consuming resources via SSL parameter renegotiation.

Recommendations For versions prior to 2.9.7, update to version 2.9.7 or later. For versions 2.10.x prior to 2.10.8, update to version 2.10.8 or later. For versions 2.11.x prior to 2.11.8, update to version 2.11.8 or later. For versions 2.12.x prior to 2.12.6, update to version 2.12.6 or later. For versions 2.13.x prior to 2.13.3, update to version 2.13.3 or later. For versions 2.14.x prior to 2.14.2, update to version 2.14.2 or later. For versions 2.15.x prior to 2.15.2, update to version 2.15.2 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-7944

DSA-3431-1

DSA-3431-2

Produtos afetados

Ganeti

Referências · 27

• 🔥 https://exploit-db.com/exploits/39169 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7945 · Nota de Segurança
• http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2 · Aviso do Fabricante
• http://debian.org/security/2016/dsa-3431 · Aviso do Fabricante
• http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-7944 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3431-2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7944 · Nota de Segurança
• http://ocert.org/advisories/ocert-2015-012.html · Correção
• https://security-tracker.debian.org/tracker/CVE-2015-7944 · Aviso do Fabricante
• http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7944 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/ganeti · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3431-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-7944 · Aviso do Fabricante