CVE-2017-5655: Infoleak
Published May 15, 2017
·Updated
In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are readable by any user authenticated on the host.
Affected Software
15 affected components
Apache Ambari=2.2.2
Apache Ambari=2.2.2-rc0
Apache Ambari=2.2.2-rc1
Apache Ambari=2.4.0
Apache Ambari=2.4.0-rc0
Apache Ambari=2.4.1
Apache Ambari=2.4.1-rc0
Apache Ambari=2.4.1-rc1
Apache Ambari=2.4.2
Apache Ambari=2.4.2-rc0
Apache Ambari=2.4.2-rc1
Apache Ambari=2.5.0
Apache Ambari=2.5.0-rc0
Apache Ambari=2.5.0-rc1
Apache Ambari=2.5.0-rc2
Event History
May 15, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-5655?
CVE-2017-5655 has a medium severity due to sensitive data being stored in temporary files that can be read by any authenticated user on the host.
2
How do I fix CVE-2017-5655?
To fix CVE-2017-5655, upgrade to Ambari version 2.4.3 or later.
3
What versions of Ambari are affected by CVE-2017-5655?
CVE-2017-5655 affects Ambari versions 2.2.2 through 2.5.0, excluding later releases.
4
What type of data is at risk in CVE-2017-5655?
CVE-2017-5655 may expose sensitive data stored in temporary files on the Ambari Server host.
5
Can unauthorized users access data exposed by CVE-2017-5655?
No, only users authenticated on the host can access the sensitive data exposed by CVE-2017-5655.