CVE-2017-2665 The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any...
HighCVSS 7.0
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb/mongodb | All versions | No fix listed |
| redhat storage console | = 2.0 | No fix listed |
| [UNKNOWN] rhscon-core | All versions | No fix listed |
References
- 97612 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory