Bugzilla – Bug 917383
VUL-1: CVE-2015-1426: facter: potential sensitive information leakage in Facter's Amazon EC2 metadata facts handling
Last modified: 2020-10-21 09:18:00 UTC
http://puppetlabs.com/security/cve/cve-2015-1426 CVE-2015-1426 - Potential sensitive information leakage in Facter’s Amazon EC2 metadata facts handling Posted February 10, 2015 Assessed Risk Level: Low An issue exists where sensitive Amazon EC2 IAM instance metadata could be added to an Amazon EC2 node's facts, where a non-privileged local user could access the information via Facter. Although Amazon’s API allows anyone who can access an EC2 instance to view its instance metadata, facts containing sensitive EC2 instance metadata could be unintentionally exposed through off-host applications that display facts. CVSS v2 Score: 1.3 Vector AV:L/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C Status: Affected Software Versions: Puppet Enterprise 2.x, 3.x Facter 1.6.0 - 2.4.0 CFacter 0.2.0 and earlier References: https://bugzilla.redhat.com/show_bug.cgi?id=1191538 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1426 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1426
bugbot adjusting priority
Affects only SLE-11. SLE-12 has facter 2.4.6 which includes the fix (https://github.com/puppetlabs/facter/commit/e546bc546e7fb23ad6b68fcf2059452df4d320dd)
Created attachment 837917 [details] Backported fix to SLE-11 facter Kristyna, Does the patch look good to you?
(In reply to Vítězslav Čížek from comment #3) > Kristyna, > Does the patch look good to you? Yes, it looks reasonable, thanks!
The patch has been submitted (mr#218441), thanks Vita! I'm closing it as fixed.
Reopening and reassigning it to the security team as it's a security issue.
Done