Date: Mon, 14 Dec 2015 16:34:22 -0500 (EST) From: cve-assign@...re.org To: jschauma@...meister.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Chef: knife bootstrap leaks validator privkey into system logs -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > https://github.com/chef/chef/issues/3871 Use CVE-2015-8559 for the originally described issue in 3871. The "sudo command logging on most reasonable systems, in the system logs. The logs may also be forwarded to other places (possibly in clear text)" scenario, at least, seems relevant. In general, an issue with unlogged private data on a command line sometimes does not have a CVE ID, if the command line only occurs during initial installation of a machine, before any unprivileged user accounts would have access. (We don't know enough about the use cases to determine whether that sometimes applies to chef.) > I can't recall but I suspect this is also a problem with the > validatorless bootstrapping as well, which copies client.pem up to the > node instead validation.pem. We aren't assigning a CVE ID for a "can't recall but I suspect this is also a problem" report. If there is a second vulnerability disclosed by lamont-granquist, then there should be a second CVE ID. > https://github.com/chef/chef/issues/3872 > > creates private files via here-doc cat(1)ing followed by running > chmod(1) and setting the permissions. > > This is a race condition if the default umask creates files world- or > group-readable (as is almost universally the case). 3872 was linked from 3871. If there is a race-condition vulnerability disclosed in 3872, we may be able to assign a CVE ID. (We would not want a CVE if the issue can occur only before unprivileged user accounts would have access.) - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWbzQ9AAoJEL54rhJi8gl5VEcQAM7Zy7BGg+vE7gVr4FRDNraQ 3M7y6DxJJhzh62RZ4Lr5ji6HfEIL2/txr3PkhbqJW9wPIb1/IGQVEgps/eNGxbSl sYnUa5qfP8zEBBRE5fJSrS2FbZaOd7AXu9W104SjVFyqTRayaYfdIAqwGOpAsMrJ dUfndrTc7bKA4zLvfGa8p7Evq7mvop23bb+pYHFnD9WqYehlgo6ZVLV9v6jS03uI DuSDvSoxKDKkq5ApkozomOiXg2VK2kGFlummVCiPZoY3H5WWKZg420mSgJqKFUR+ f+1jHsgyhD3KngSDowvTAY/j8PX2JkDCJ29BImKagKChFZgHjNcKZBQyNtmSE55e aun489CNsLWpRs3hlY2ZQ0IObF4Qs94lFSNEJRNbrIS/7soOJF16BoL+PZxkAAyF COJ9FoZIfVSbSwdwqf1HfGpzooPsspWOMuSoNyjFXCMdvDksQOogte0CDzp/L1r+ iV7gDEiO6teaTtnL4wp5uN4w+fWwU4BtNfDhzPUQRmo2CQrMQrShZ9+ko29/itiM sGwRgnSHS4Z/Hd//Kgw7VFGbUFQ4NN8qY9q4NlFUVdZO6bDmaR7G/d59GqWh608C lBB61MXqkcYN1LMJE/erzY9yZFocJMsy4/zxDQmwcoAF285/Hzfh2sDLuzxO2WL1 UJGdkZaz2pwZh4JG22m8 =yZOJ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.