Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Ganeti 安全漏洞
Vulnerability Description
Ganeti是一套基于Xen虚拟机管理器和其他开源软件的虚拟机管理软件。该软件支持Xen虚拟化技术、磁盘管理等。 Ganeti 2.10.7之前2.10.0版本和2.11.5之前2.11.0版本中lib/client/gnt_cluster.py文件的‘_UpgradeBeforeConfigurationChange’函数中存在安全漏洞，该漏洞源于程序对配置备份文件使用全局读权限。本地攻击者可通过读取与upgrade命令相关的文件利用该漏洞获取SSL密钥，远程API证书和其他敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A