CVE-2017-2665

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-2665
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2665.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-2665
Downstream
Published
2018-07-06T13:29:00.217Z
Modified
2026-07-08T15:11:10.371785Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
695c67dff0ffc361b8568a13366f027caa406222
Last affected
695c67dff0ffc361b8568a13366f027caa406222
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:redhat:storage_console:2.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.0
r2.*
r2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2665.json"