{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-13T00:00:00", "descriptions": [{"lang": "en", "value": "Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-05-08T12:57:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://theforeman.org/security.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-0135", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://theforeman.org/security.html", "refsource": "CONFIRM", "url": "http://theforeman.org/security.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:05:38.996Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://theforeman.org/security.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-0135", "datePublished": "2014-05-08T14:00:00", "dateReserved": "2013-12-03T00:00:00", "dateUpdated": "2024-08-06T09:05:38.996Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:kafo:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEDA6869-9D6C-465A-AEA9-9BD807BB9CD3", "versionEndIncluding": "0.3.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "E06B70A9-926A-42C9-B32E-A1F5DDE70694", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "C45AAA87-928A-44F4-BE0D-96C920073E92", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "D36C2690-6550-4540-A1B3-A404109BC3F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "15D37C7A-3EF5-4E95-9EBB-B639F0F3E5F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "582CDBEE-21CA-4828-95D4-F0C86C1E708C", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "E8DBD26C-2B23-4003-AC6C-912752AD166F", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "B75554D2-A3C2-44A0-B1CC-2E838B8014A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "0F66CF6A-FF98-4F65-B60C-DC59777A8A8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "1A569A29-6ABF-4359-9508-B12EA6E89B30", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "89B27CD1-5136-43D1-8A99-7E6FEC4BE700", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "D54B8D65-E309-462F-BBA3-39724A29CC87", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "4E800948-7659-430D-8AA1-037F45D69D2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "26BD255A-FC21-4148-BACB-B7C5FA582047", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "1E98BEA7-E849-4D43-B9FC-FA57EC3248EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "146F8AFF-B014-4AF5-882F-B87FE6B1161F", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "194DC2C9-F4B7-4EFA-84EF-401F8CA73654", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "0D53BA71-3ECB-47B5-883F-1A81BF823E8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "523F795C-B841-4895-8915-5BBB7795DA74", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "2C65F14E-BB16-4996-BB18-35E5718A36B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "25EAF80A-87DA-41B5-8E3F-6BFB78677BF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "713E9773-35CF-4435-809A-06C5970E5261", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "5EDFA8BD-DEC6-4B97-AA5B-87B6ED237192", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "BA736CD3-8FBB-49C7-B564-40A4888821D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "3E91F250-1BD2-4A49-86E8-59FF4C134F7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "ECB5FB7E-7C30-41B3-8CED-A8CD1B681856", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "E45CE822-180D-48FA-B0D7-299C5EBBC066", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "41AF2F1B-D25C-4E5C-B148-EADB8DD15092", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "C23E6100-188D-4607-AAD2-95C96EDCAF23", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "C1DAFC70-B034-4E10-A87F-46369EFACAF3", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "993E084A-8E6F-42DF-9550-07BB399D4319", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "7D476C3E-0149-4E9E-A2B1-8D37A2D8EA63", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.10:*:*:*:*:*:*:*", "matchCriteriaId": "AEBBD111-46E6-4BDB-A10C-F8D2EB2CD329", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "E8697FA5-CE88-4CF5-9BD6-6AA232CE4A3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "EF328E69-72DE-47A0-8834-55BE8F875229", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.13:*:*:*:*:*:*:*", "matchCriteriaId": "10ED8374-3BDC-489A-9F68-DF5DA3A7A332", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.14:*:*:*:*:*:*:*", "matchCriteriaId": "DC480FE8-996F-4A61-BD49-B6A422777EA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.3.15:*:*:*:*:*:*:*", "matchCriteriaId": "4F43CB8E-8F9E-45F7-8251-D8872C06F2D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "6383C4B3-2105-4888-B30E-A5FDEACF9FA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "BDB29E10-A3AD-4A7D-B573-D581676542E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:theforeman:kafo:0.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "A9C36751-1EC7-47B1-ABDA-BA0D05292870", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file."}, {"lang": "es", "value": "Kafo anterior a 0.3.17 y 0.4.x anterior a 0.5.2, utilizado por Foreman, utiliza permisos de lectura universal para default_values.yaml, lo que permite a usuarios locales obtener contrase\u00f1as y otra informaci\u00f3n sensible mediante la lectura del archivo."}], "id": "CVE-2014-0135", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-08T14:29:13.283", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://theforeman.org/security.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://theforeman.org/security.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHEA-2014:1175", "cpe": "cpe:/a:redhat:satellite:6.0::el6", "package": "rubygem-kafo-0:0.6.4-2.el7sat", "product_name": "Red Hat Satellite 6.0", "release_date": "2014-09-10T00:00:00Z"}, {"advisory": "RHEA-2014:1175", "cpe": "cpe:/a:redhat:satellite:6.0::el6", "package": "rubygem-kafo_parsers-0:0.0.3-2.el7sat", "product_name": "Red Hat Satellite 6.0", "release_date": "2014-09-10T00:00:00Z"}, {"advisory": "RHEA-2014:1175", "cpe": "cpe:/a:redhat:satellite_capsule:6.0::el6", "package": "rubygem-kafo-0:0.6.4-2.el7sat", "product_name": "Red Hat Satellite 6.0", "release_date": "2014-09-10T00:00:00Z"}, {"advisory": "RHEA-2014:1175", "cpe": "cpe:/a:redhat:satellite_capsule:6.0::el6", "package": "rubygem-kafo_parsers-0:0.0.3-2.el7sat", "product_name": "Red Hat Satellite 6.0", "release_date": "2014-09-10T00:00:00Z"}], "bugzilla": {"description": "rubygem-kafo: temporary file creation vulnerability when creating /tmp/default_values.yaml", "id": "1076335", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1076335"}, "csaw": false, "cvss": {"cvss_base_score": "4.6", "cvss_scoring_vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "status": "verified"}, "cwe": "(CWE-377|CWE-367|CWE-732)", "details": ["Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file."], "name": "CVE-2014-0135", "package_state": [{"cpe": "cpe:/a:redhat:openstack:5::el6", "fix_state": "Will not fix", "package_name": "rubygem-kafo", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)"}, {"cpe": "cpe:/a:redhat:openstack:4", "fix_state": "Will not fix", "package_name": "rubygem-kafo", "product_name": "Red Hat OpenStack Platform 4"}], "public_date": "2015-02-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-0135\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-0135"], "threat_severity": "Moderate"}