[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20151214214206.GB18118@netmeister.org>
Date: Mon, 14 Dec 2015 16:42:06 -0500
From: Jan Schaumann <jschauma@...meister.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: Chef: knife bootstrap leaks validator privkey
into system logs
cve-assign@...re.org wrote:
> In general, an issue with unlogged private data on a command line
> sometimes does not have a CVE ID, if the command line only occurs
> during initial installation of a machine, before any unprivileged user
> accounts would have access. (We don't know enough about the use cases
> to determine whether that sometimes applies to chef.)
It's possible that Chef is installed/bootstrapped on a system that is
already configured/set-up and used by other users.
User management may be done entirely outside of Chef, so that there is
no universal guarantee that Chef would only ever be installed when no
other unprivileged users would have access to the system (even if that
is likely to be the majority of the use cases).
> > https://github.com/chef/chef/issues/3872
> >
> > creates private files via here-doc cat(1)ing followed by running
> > chmod(1) and setting the permissions.
> >
> > This is a race condition if the default umask creates files world- or
> > group-readable (as is almost universally the case).
>
> 3872 was linked from 3871. If there is a race-condition vulnerability
> disclosed in 3872, we may be able to assign a CVE ID. (We would not
> want a CVE if the issue can occur only before unprivileged user
> accounts would have access.)
As above: no such guarantee, even though most people may well bootstrap
Chef only in such environments.
-Jan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
