oCERT-2015-012 Ganeti multiple issues
Ganeti, an open source virtualization manager, suffers from multiple issues in its RESTful control interface (RAPI).
The distributed replicated storage (DRBD) secret is leaked by the
RAPI interface when job results are requested.
Leveraging on the knowledge of this secret, a malicious user who had already gained access to the storage network of the cluster can retrieve instance data more easily and reliably.
The RAPI interface is also vulnerable to a DoS condition, triggered
via SSL parameter renegotiation issued by a malicious client.
The condition leads to resource exhaustion on the master node.
Ganeti <= 2.9.6, <= 2.10.7, <= 2.11.7, <= 2.12.5, <= 2.13.2, <= 2.14.1, <= 2.15.1
Ganeti >= 2.9.7, >= 2.10.8, >= 2.11.8, >= 2.12.6, >= 2.13.3, >= 2.14.2, >= 2.15.2
Credit: vulnerability reported by Pierre Kim <pierre [dot] kim [dot] sec [at] gmail [dot] com>.
2015-12-21: vulnerability report received
2015-12-24: contacted affected vendors
2015-12-30: advisory release