PT-2019-7076 · Canonical · Ubuntu Maas

Blake Rouse · Published 2019-04-22 · Updated 2019-10-09 · CVE-2014-1426

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubuntu MAAS versions prior to 1.9.2

Description A vulnerability in the maasserver.api.get file by name function of Ubuntu MAAS allows unauthenticated network clients to download any file.

Recommendations For versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the maasserver.api.get file by name function to prevent unauthorized file downloads.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-1426

Affected Products

Ubuntu Maas

References · 5

• https://cve.org/CVERecord?id=CVE-2014-1426 · Security Note
• https://ubuntu.com/security/CVE-2014-1426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1426 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1426 · Vendor Advisory
• https://launchpad.net/maas/+milestone/1.9.2 · Note