CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

PT-2014-6363

Name of the Vulnerable Software and Affected Versions Ganeti versions 2.10.0 through 2.10.6 Ganeti versions 2.11.0 through 2.11.4 Description The issue allows local users to obtain sensitive information, including SSL keys and remote API credentials, by reading a configuration backup file. This i...