{"id":"CVE-2014-0135","aliases":["EUVD-2022-4250","GHSA-hxvp-655x-xxqv","RHEA-2014:1175"],"status":"published","title":"Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml","description":"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.","severity":{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00331,"percentile":0.26514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-05-08T14:00:00Z","modified":"2026-10-07T10:01:18Z","fixes":[{"ecosystem":"RubyGems","package":"kafo","fixed_in":["0.3.17","0.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.17"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.17"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.10","0.3.11","0.3.12","0.3.13","0.3.14","0.3.15","0.3.16","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9"]},{"source":"osv","ecosystem":"RubyGems","package":"kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.5.2"}]}],"versions":["0.4.0","0.5.0","0.5.1"]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"libmongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"libmongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-30.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-30.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-1.el6"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-1.el6"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-6.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-6.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-hammer_cli_foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-16.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-hammer_cli_foreman_tasks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-hammer_cli_foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-16.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-hammer_cli_foreman_tasks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-4.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-4.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-5.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-simplejson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-5.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-simplejson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24}],"products":[{"vendor":"theforeman","product":"kafo"}],"references":[{"url":"http://theforeman.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0135","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kafo/CVE-2014-0135.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hxvp-655x-xxqv"},{"url":"https://github.com/theforeman/kafo","tags":["package"]},{"url":"https://access.redhat.com/errata/RHEA-2014:1175","tags":["advisory"]},{"url":"https://access.redhat.com/site/documentation/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1131602","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhea-2014_1175.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049748","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6619","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=963568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2101","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=968166","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2121","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=991116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2882","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2882","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=989755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4180","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=990374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=991318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4201","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997639","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4225","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013076","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4386","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039888","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6639","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1059070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6650","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-7440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1224999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7440","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1105369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0007","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0192","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1094642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0208","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1099419","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0241","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-1704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1077136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1704","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1108745","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3531","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-4616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4616","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-0135","description":"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.","status":"published","published":"2014-05-08T14:00:00Z","modified":"2024-08-06T09:05:38.996Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2022-4250","description":"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.","status":"published","published":"2014-05-08T14:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-hxvp-655x-xxqv","title":"Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml","description":"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for `default_values.yaml`, which allows local users to obtain passwords and other sensitive information by reading the file.","status":"published","published":"2022-05-17T04:44:31Z","modified":"2023-08-29T10:35:28Z","updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2014-0135","description":"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.","status":"published","published":"2014-05-08T14:29:13.283Z","modified":"2026-06-17T00:02:21.713Z","cvss":[{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-hxvp-655x-xxqv","title":"Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml","description":"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for `default_values.yaml`, which allows local users to obtain passwords and other sensitive information by reading the file.","status":"published","published":"2022-05-17T04:44:31Z","modified":"2024-12-06T05:38:12.351755Z","updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"RHEA-2014:1175","title":"Red Hat Enhancement Advisory: Release of Satellite 6.0","status":"published","published":"2024-09-15T21:58:55Z","modified":"2026-10-07T10:01:18Z","updated_at":"2026-11-02T15:52:58.636919Z"}]}}