Bug 1221989 (CVE-2015-3201)
| Summary: | CVE-2015-3201 thermostat: world-readable configuration file containing credentials | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | jorton, mmaslano, neugens, omajid, security-response-team, sgehwolf |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
It was discovered that the Thermostat web application stored database authentication credentials in a world-readable configuration file. A local user on a system running the Thermostat web application could use this flaw to access and modify monitored JVM data, or perform actions on connected JVMs.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-06-04 08:13:15 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1222621, 1223505 | ||
| Bug Blocks: | 1221990 | ||
|
Description
Martin Prpič
2015-05-15 12:17:54 UTC
Acknowledgements: This issue was discovered by the Red Hat Thermostat Team. Created thermostat tracking bugs for this issue: Affects: fedora-all [bug 1223505] Upstream bug report: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2372 Upstream commit: http://icedtea.classpath.org/hg/thermostat/rev/c2f18f81f57a Additional related fix: http://icedtea.classpath.org/hg/thermostat/rev/4a5706c9f0cb This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2015:1052 https://rhn.redhat.com/errata/RHSA-2015-1052.html thermostat-1.2.2-7.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. thermostat-1.0.6-2.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. |