Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml

2022-05-1704:44:31

Google

osv.dev

0.0004 Low

EPSS

Percentile

5.1%

JSON

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.

CPENameOperatorVersion
kafoeq0.0.16
kafoeq0.3.14
kafoeq0.3.12
kafoeq0.0.4
kafoeq0.3.1
kafoeq0.3.15
kafoeq0.0.14
kafoeq0.2.0
kafoeq0.3.16
kafoeq0.0.12

Name	Operator	Version
kafo	eq	0.0.16
kafo	eq	0.3.14
kafo	eq	0.3.12
kafo	eq	0.0.4
kafo	eq	0.3.1
kafo	eq	0.3.15
kafo	eq	0.0.14
kafo	eq	0.2.0
kafo	eq	0.3.16
kafo	eq	0.0.12

Rows per page:

1-10 of 411

References

theforeman.org/security.html

github.com/rubysec/ruby-advisory-db/blob/master/gems/kafo/CVE-2014-0135.yml

github.com/theforeman/kafo

nvd.nist.gov/vuln/detail/CVE-2014-0135

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:GHSA-HXVP-655X-XXQV