CVE-2015-7944

High

Published: 18/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The RESTful control interface (RAPI) in Ganeti before version 2.9.7 and in versions 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.

Risk Assessment

Attackers can exploit this vulnerability to exhaust system resources, potentially leading to service unavailability.

Recommendation

It is recommended to update Ganeti to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Ganeti

CVE-2015-7945High
The RESTful control interface (RAPI) in Ganeti before version 2.9.7 and in versions 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.

Original NVD description (English source)

The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS