Bug 908629 (CVE-2012-6120) - CVE-2012-6120 Puppet: Directory /var/log/puppet is world readable
Summary: CVE-2012-6120 Puppet: Directory /var/log/puppet is world readable
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-6120
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 908915 908917 908948 908949 908950 908951 995672
Blocks: 908633 921763
TreeView+ depends on / blocked
 
Reported: 2013-02-07 08:19 UTC by Kurt Seifried
Modified: 2019-09-29 13:00 UTC (History)
31 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-01-29 03:39:06 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0710 0 normal SHIPPED_LIVE Important: puppet security update 2013-04-05 00:18:54 UTC

Description Kurt Seifried 2013-02-07 08:19:20 UTC 
/var/log/puppet is world readable and may contain sensitive information

Also the files contained within are world readable.

Version-Release number of selected component (if applicable):

puppet-2.6.14-1.el6.noarch
puppet-2.6.17-2.el6.noarch

How reproducible:

drwxr-xr-x.  2 puppet        puppet          4096 Mar  8 16:35 /var/log/puppet
Comment 2 Kurt Seifried 2013-02-07 20:47:54 UTC 
Created puppet tracking bugs for this issue

Affects: epel-all [bug 908915]
Comment 7 Alan Pevec 2013-02-18 23:22:34 UTC 
(In reply to comment #0)
> Lukas Zapletal reports:
> 
> /var/log/puppet is world readable and may contain sensitive information

FYI that was EPEL bug https://bugzilla.redhat.com/show_bug.cgi?id=857930
Comment 8 Todd Zullinger 2013-03-18 14:19:11 UTC 
And this was a bug in the build system, not in the packaging.  A recent update and build without change to the spec file shows that /var/log/puppet now retains the proper permissions.

I don't seem to have any access to the blocker bugs, so I don't know what the security team wants to do about closing this out.  Please advise or close as appropriate.
Comment 9 Kurt Seifried 2013-03-21 06:25:06 UTC 
The blocker bugs and depends on bugs are for Red Hat internal purposes, a tracking bug for EPEL was created (908915) and you were assigned to it, and it was closed properly so that's all you need to worry about on your side. Basically SRT handles closing of all CVE bugs (like this one).
Comment 11 errata-xmlrpc 2013-04-04 20:20:05 UTC 
This issue has been addressed in following products:

  OpenStack Folsom for RHEL 6

Via RHSA-2013:0710 https://rhn.redhat.com/errata/RHSA-2013-0710.html
Comment 12 Kurt Seifried 2013-07-26 06:21:52 UTC 
The Red Hat Security Response Team has rated this issue as having low security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.
Note You need to log in before you can comment on or make changes to this bug.