CVE-2014-5247
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0...
CVE-2014-5247 is a low vulnerability (CVSS 2.1) in Spi-inc Ganeti, published August 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in ganeti 2.11.5-1.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.49%EPSS, 42nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.11.5-1ganeti +1 more
Description
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
CVE-2014-5247- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
CVE-2014-5247- Updated
- 2026-11-02
EUVDEUVD-2014-5143No score
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
EUVD-2014-5143- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqwx-x2jv-r288No score
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0...
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
GHSA-rqwx-x2jv-r288- Updated
- 2026-11-02
OSVNo score
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
CVE-2014-5247- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5247No score
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
DEBIAN-CVE-2014-5247- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5247No score
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.
- Record
UBUNTU-CVE-2014-5247- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
git.ganeti.org?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0
exchange.xforce.ibmcloud.com/vulnerabilities/95256
packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html
securityfocus.com/archive/1/533119/100/0/threaded
seclists.org/oss-sec/2014/q3/370
Show 7 moreShow less
ocert.org/advisories/ocert-2014-006.html
nvd.nist.gov/vuln/detail/CVE-2014-5247
github.com/advisories/GHSA-rqwx-x2jv-r288
security-tracker.debian.org/tracker/CVE-2014-5247
ubuntu.com/security/CVE-2014-5247
cve.org/CVERecord?id=CVE-2014-5247