CVE-2015-7945

Related Files

Ganeti Denial Of Service / Information Disclosure

Posted Jan 5, 2016

Authored by Pierre Kim

Ganeti suffers from unauthenticated information disclosure and denial of service vulnerabilities.

tags | exploit, denial of service, vulnerability, info disclosure

advisories | CVE-2015-7944, CVE-2015-7945

SHA-256 | b366b0e8cdc76ece2a45806306e7e5adc7f7ed618bac49a090623b0b34db5e3c

Download | Favorite | View

Debian Security Advisory 3431-1

Posted Jan 1, 2016

Authored by Debian | Site debian.org

Debian Linux Security Advisory 3431-1 - Pierre Kim discovered two vulnerabilities in the restful API of Ganeti, a virtual server cluster management tool. SSL parameter negotiation could result in denial of service and the DRBD secret could leak.

tags | advisory, denial of service, vulnerability

systems | linux, debian

advisories | CVE-2015-7944, CVE-2015-7945

SHA-256 | a01b455cafe98df2e893e64cd046ef310b011a73d6fce093f20678aa83e07f64

Download | Favorite | View

Ganeti Leaked Secret / Denial Of Service

Posted Dec 31, 2015

Authored by Open Source CERT, Daniele Bianco

Ganeti, an open source virtualization manager, suffers from multiple issues in its RESTful control interface (RAPI). The distributed replicated storage (DRBD) secret is leaked by the RAPI interface when job results are requested. Leveraging on the knowledge of this secret, a malicious user who had already gained access to the storage network of the cluster can retrieve instance data more easily and reliably. The RAPI interface is also vulnerable to a denial of service condition, triggered via SSL parameter renegotiation issued by a malicious client. The condition leads to resource exhaustion on the master node. Many versions are affected.

tags | advisory, denial of service

advisories | CVE-2015-7944, CVE-2015-7945

SHA-256 | 4908b0ea745ca775be075350bb329e3afa85d1d65858822a85447b0558240754

Download | Favorite | View