PT-2019-6945 · Ovirt · Ovirt Engine

Yedidyah Bar David · Publicado 2019-11-01 · Atualizado 2019-11-07 · CVE-2013-4367

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ovirt-engine version 3.2

Description The issue arises from an upstream kernel change affecting how python's os.chmod() works when passed a mode of '-1', resulting in certain files being created world-writeable on Linux kernel 3.1 and newer.

Recommendations For ovirt-engine version 3.2, consider modifying the file creation process to explicitly set the desired permissions, avoiding the use of '-1' as a mode for os.chmod().

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2013-4367

Produtos afetados

Ovirt Engine

Referências · 3

• https://access.redhat.com/security/cve/cve-2013-4367 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4367 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-4367 · Nota de Segurança