PT-2017-7436 · Chef · Chef Infra Client

Jschauma · Publicado 2017-09-21 · Atualizado 2021-06-28 · CVE-2015-8559

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chef Infra client versions prior to 15.4.45

Description The issue concerns the knife bootstrap command in Chef Infra client, which leaks the validator.pem private RSA key to /var/log/messages.

Recommendations For versions prior to 15.4.45, update to version 15.4.45 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-8559

Produtos afetados

Chef Infra Client

Referências · 10

• https://github.com/chef/chef/issues/3871 · Correção
• https://github.com/chef/chef/pull/8885 · Nota
• https://discourse.chef.io/t/chef-infra-client-15-4-45-released/16081 · Nota
• https://t.me/cvenotify/14479 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-8559 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/12/14/10 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8559 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8559 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/12/14/14 · Nota
• https://cve.org/CVERecord?id=CVE-2015-8559 · Nota de Segurança