CVE-2015-7945

Name of the Vulnerable Software and Affected Versions Ganeti versions prior to 2.9.7 Ganeti versions 2.10.x prior to 2.10.8 Ganeti versions 2.11.x prior to 2.11.8 Ganeti versions 2.12.x prior to 2.12.6 Ganeti versions 2.13.x prior to 2.13.3 Ganeti versions 2.14.x prior to 2.14.2 Ganeti versions 2.15.x prior to 2.15.2

Description The issue allows remote attackers to obtain the DRBD secret via instance information job results, specifically through the RESTful control interface, also known as RAPI or ganeti-rapi.

Recommendations For versions prior to 2.9.7, update to version 2.9.7 or later. For versions 2.10.x prior to 2.10.8, update to version 2.10.8 or later. For versions 2.11.x prior to 2.11.8, update to version 2.11.8 or later. For versions 2.12.x prior to 2.12.6, update to version 2.12.6 or later. For versions 2.13.x prior to 2.13.3, update to version 2.13.3 or later. For versions 2.14.x prior to 2.14.2, update to version 2.14.2 or later. For versions 2.15.x prior to 2.15.2, update to version 2.15.2 or later.