CVE-2015-7944

Description

The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8
• http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8
• http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6
• http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3
• http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2
• http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2
• http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7
• http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.html
• http://www.debian.org/security/2016/dsa-3431
• http://www.ocert.org/advisories/ocert-2015-012.html
• https://www.exploit-db.com/exploits/39169/
• https://security-tracker.debian.org/tracker/CVE-2015-7944

CWEs

CWE-399

💬 Discuss CVE-2015-7944 on VIR Community →

Community-verified mitigations for this CVE will appear above when contributors publish them.