Vulnerability Name:

CVE-2017-1000199 (CCN-135774)

Assigned:2017-11-16
Published:2017-11-16
Updated:2017-12-02
Summary:tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2017-1000199

Source: REDHAT
Type: UNKNOWN
RHSA-2017:3277

Source: XF
Type: UNKNOWN
tcmurunner-cve20171000199-info-disc(135774)

Source: CCN
Type: tcmu-runner GIT Repository
Security information leak in internal qcow handler's check_config callback #194

Source: MISC
Type: Third Party Advisory
https://github.com/open-iscsi/tcmu-runner/issues/194

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-1000199

Vulnerable Configuration:Configuration 1:
  • cpe:/a:tcmu-runner_project:tcmu-runner:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:0.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:1.2.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:tcmu-runner_project:tcmu-runner:1.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:tcmu-runner_project:tcmu-runner:0.9.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20171000199
    V
    		CVE-2017-1000199
    2022-05-20
    oval:org.opensuse.security:def:42173
    P
    		Security update for xz (Important)
    2022-04-12
    oval:org.opensuse.security:def:42344
    P
    		Security update for ucode-intel (Important)
    2022-02-25
    oval:org.opensuse.security:def:42242
    P
    		Security update for the Linux Kernel (Important)
    2021-12-06
    oval:org.opensuse.security:def:20301
    P
    		Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP4) (Important)
    2021-10-12
    oval:org.opensuse.security:def:20518
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:14787
    P
    		transfig-3.2.5e-2.3.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14861
    P
    		ctags-5.8-7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14598
    P
    		libical1-1.0.1-16.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14693
    P
    		libxerces-c-3_1-3.1.1-12.3 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14494
    P
    		gd-2.1.0-24.9.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14528
    P
    		jakarta-commons-fileupload-1.1.1-120.113 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14888
    P
    		fontconfig-2.11.1-7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14669
    P
    		libsrtp1-1.5.2-3.2.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14814
    P
    		zoo-2.10-1020.56 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14502
    P
    		glibc-2.22-15.3 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14872
    P
    		dnsmasq-2.78-18.9.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:14649
    P
    		libprocps3-3.3.9-11.14.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:20485
    P
    		Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP5) (Important)
    2021-07-27
    oval:org.opensuse.security:def:15549
    P
    		augeas-devel-1.2.0-1.5 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42710
    P
    		sysstat-8.1.5-7.50.25 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42520
    P
    		dnsmasq-2.71-0.14.9 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17020
    P
    		libpolkit0-32bit-0.112-2.189 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17196
    P
    		libplist++3-1.12-19.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15526
    P
    		wireshark-1.12.13-31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42681
    P
    		ppp-2.4.5.git-2.29.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17139
    P
    		libwebkit2gtk-3_0-25-2.4.8-16.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17263
    P
    		libmysqlclient_r18-10.0.35-1.7 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17012
    P
    		libfbembed2_5-2.5.2.26539-13.42 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42636
    P
    		libwsman1-2.2.3-0.8.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42584
    P
    		libarchive2-2.5.5-5.19 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17054
    P
    		gnome-online-accounts-3.10.5-1.11 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17227
    P
    		colord-1.3.3-12.13 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42064
    P
    		Security update for libnettle (Important)
    2021-04-28
    oval:org.opensuse.security:def:56979
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:56978
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:20243
    P
    		Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP4) (Important)
    2021-04-07
    oval:org.opensuse.security:def:20588
    P
    		Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP5) (Important)
    2021-03-17
    oval:org.opensuse.security:def:20576
    P
    		Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP5) (Important)
    2021-03-17
    oval:org.opensuse.security:def:57559
    P
    		Security update for MozillaFirefox (Important)
    2021-03-01
    oval:org.opensuse.security:def:20612
    P
    		Security update for salt (Critical)
    2021-02-26
    oval:org.opensuse.security:def:38151
    P
    		Security update for jasper (Important)
    2021-02-16
    oval:org.opensuse.security:def:57145
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-02-10
    oval:org.opensuse.security:def:57001
    P
    		Security update for flac (Moderate)
    2021-01-04
    oval:org.opensuse.security:def:57838
    P
    		Security update for openssl (Important)
    2020-12-11
    oval:org.opensuse.security:def:57384
    P
    		Security update for postgresql12 (Important)
    2020-12-04
    oval:org.opensuse.security:def:17373
    P
    		libwmf-0_2-7-0.2.8.4-242.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:42761
    P
    		sblim-sfcb-openssl1-1.3.11-0.28.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17405
    P
    		Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:41820
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:58524
    P
    		Security update for java-1_8_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:57668
    P
    		apache2-mod_nss on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38941
    P
    		bogofilter on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38383
    P
    		libtiff5-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58234
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:43444
    P
    		Security update for tcmu-runner (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:20157
    P
    		Security update for the Linux Kernel (Live Patch 25 for SLE 12) (Important)
    2020-12-01
    oval:org.opensuse.security:def:39652
    P
    		Security update for libical (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38634
    P
    		libIlmImf-Imf_2_1-21 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38150
    P
    		coolkey on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:20335
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17474
    P
    		Security update for libproxy (Important)
    2020-12-01
    oval:org.opensuse.security:def:18160
    P
    		Security update for tcmu-runner (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:41809
    P
    		Security update for unzip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58441
    P
    		Security update for w3m (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38902
    P
    		icu on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58549
    P
    		Security update for tcmu-runner (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38246
    P
    		libSoundTouch0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58124
    P
    		Security update for gstreamer-0_10-plugins-base (Important)
    2020-12-01
    oval:org.opensuse.security:def:43399
    P
    		Security update for poppler (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:20122
    P
    		Security update for cups (Important)
    2020-12-01
    oval:org.opensuse.security:def:39014
    P
    		gnome-shell-calendar on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:41808
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:38544
    P
    		apache2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17462
    P
    		Security update for compat-openssl098 (Important)
    2020-12-01
    oval:org.opensuse.security:def:38853
    P
    		java-1_7_0-openjdk-plugin on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:21276
    P
    		Security update for tcmu-runner (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18134
    P
    		Security update for libraw (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58403
    P
    		Security update for postgresql10 (Low)
    2020-12-01
    oval:org.opensuse.security:def:41912
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:58474
    P
    		Security update for postgresql94 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38162
    P
    		cvs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38969
    P
    		libmysqlclient_r18 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38486
    P
    		squid on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:39694
    P
    		Security update for tcmu-runner (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:38794
    P
    		rsyslog on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:21250
    P
    		Security update for openssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:20373
    P
    		Security update for dovecot22 (Low)
    2020-12-01
    oval:org.opensuse.security:def:17496
    P
    		Security update for postgresql10 (Important)
    2020-12-01
    oval:org.opensuse.security:def:20114
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:58327
    P
    		Security update for squid (Critical)
    2020-12-01
    oval:org.opensuse.security:def:81259
    P
    		Security update for tcmu-runner (Moderate)
    2017-09-29
    BACK
    tcmu-runner_project tcmu-runner 0.9.1
    tcmu-runner_project tcmu-runner 0.9.2
    tcmu-runner_project tcmu-runner 0.9.3
    tcmu-runner_project tcmu-runner 0.9.4
    tcmu-runner_project tcmu-runner 1.0.5
    tcmu-runner_project tcmu-runner 1.1.0
    tcmu-runner_project tcmu-runner 1.1.1
    tcmu-runner_project tcmu-runner 1.1.2
    tcmu-runner_project tcmu-runner 1.1.3
    tcmu-runner_project tcmu-runner 1.2.0
    tcmu-runner_project tcmu-runner 1.2.0
    tcmu-runner_project tcmu-runner 0.9.1