PatchTheCVEganeti vulnerabilities and fixes
Recent CVEs affecting ganeti, with upgrade or downgrade steps. 3 tracked.
ganeti has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2017-08-18. Highest priority: CVE-2015-7945 (score 60/100).
- CVE-2015-7945 HIGH 7.5 UPGRADE The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x b
- CVE-2015-7944 HIGH 7.5 UPGRADE The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x b
- CVE-2014-5247 LOW 2.1 DOWNGRADE The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and
FAQ
How do I fix ganeti vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ganeti being exploited right now?
None of the tracked ganeti CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ganeti CVE should I patch first?
CVE-2015-7945 currently ranks highest (60/100): The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x b.