ADVISORIES

• CVE-2014-0135 (NVD)
• GHSA-hxvp-655x-xxqv
• OSVDB-106826

GEM

kafo

SEVERITY

CVSS v2.0: 1.9 (Low)

PATCHED VERSIONS

• ~> 0.3.17
• >= 0.5.2

DESCRIPTION

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.

RELATED

• https://github.com/rubysec/ruby-advisory-db/issues/238
• https://sca.analysiscenter.veracode.com/vulnerability-database/security/world-readable-permissions-as-default/ruby/sid-740/summary