CVE-2015-7944

Vulnerability Description

The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7Release NotesVendor Advisory
• http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-ServiPatchThird Party AdvisoryVDB Entry
• http://www.debian.org/security/2016/dsa-3431
• http://www.ocert.org/advisories/ocert-2015-012.htmlPatchThird Party AdvisoryVDB Entry
• https://www.exploit-db.com/exploits/39169/
• http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6Release NotesVendor Advisory
• http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3Release NotesVendor Advisory