CVE-2017-5655: Infoleak
First published: Mon May 15 2017(Updated: )
In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are readable by any user authenticated on the host.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Ambari | =2.2.2 | |
| Apache Ambari | =2.2.2-rc0 | |
| Apache Ambari | =2.2.2-rc1 | |
| Apache Ambari | =2.4.0 | |
| Apache Ambari | =2.4.0-rc0 | |
| Apache Ambari | =2.4.1 | |
| Apache Ambari | =2.4.1-rc0 | |
| Apache Ambari | =2.4.1-rc1 | |
| Apache Ambari | =2.4.2 | |
| Apache Ambari | =2.4.2-rc0 | |
| Apache Ambari | =2.4.2-rc1 | |
| Apache Ambari | =2.5.0 | |
| Apache Ambari | =2.5.0-rc0 | |
| Apache Ambari | =2.5.0-rc1 | |
| Apache Ambari | =2.5.0-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-5655?
CVE-2017-5655 has a medium severity due to sensitive data being stored in temporary files that can be read by any authenticated user on the host.
How do I fix CVE-2017-5655?
To fix CVE-2017-5655, upgrade to Ambari version 2.4.3 or later.
What versions of Ambari are affected by CVE-2017-5655?
CVE-2017-5655 affects Ambari versions 2.2.2 through 2.5.0, excluding later releases.
What type of data is at risk in CVE-2017-5655?
CVE-2017-5655 may expose sensitive data stored in temporary files on the Ambari Server host.
Can unauthorized users access data exposed by CVE-2017-5655?
No, only users authenticated on the host can access the sensitive data exposed by CVE-2017-5655.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/apache
- canonical/apache ambari
- version/apache ambari/2.2.2
- version/apache ambari/2.2.2-rc0
- version/apache ambari/2.2.2-rc1
- version/apache ambari/2.4.0
- version/apache ambari/2.4.0-rc0
- version/apache ambari/2.4.1
- version/apache ambari/2.4.1-rc0
- version/apache ambari/2.4.1-rc1
- version/apache ambari/2.4.2
- version/apache ambari/2.4.2-rc0
- version/apache ambari/2.4.2-rc1
- version/apache ambari/2.5.0
- version/apache ambari/2.5.0-rc0
- version/apache ambari/2.5.0-rc1
- version/apache ambari/2.5.0-rc2