Vulnerability Description
tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges.
CVSS Score
7.5
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tcmu-Runner Project | Tcmu-Runner | 0.9.1 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2017:3277
- https://github.com/open-iscsi/tcmu-runner/issues/194Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3277
- https://github.com/open-iscsi/tcmu-runner/issues/194Third Party Advisory
FAQ
What is CVE-2017-1000199?
CVE-2017-1000199 is a vulnerability with a CVSS score of 7.5 (HIGH). tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges.
How severe is CVE-2017-1000199?
CVE-2017-1000199 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-1000199?
Check the references section above for vendor advisories and patch information. Affected products include: Tcmu-Runner Project Tcmu-Runner.