Red Hat Security AdvisoryRHSA-2013:1603
luci security, bug fix, and enhancement update
Released 2013-11-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux High Availability (v. 6) luci-0.26.0-48.el6
- Red Hat Enterprise Linux Resilient Storage (v. 6) luci-0.26.0-48.el6
Fixes 2 records
Priority LOW 28
Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current workin…
CVSS 2.0MEDIUM 6.2· Local · No auth · Interaction — · EPSS 0.00378 · Published 2013-11-23 · Fixed
Priority LOW 10
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "aut…
CVSS 2.0LOW 1.9· Local · No auth · Interaction — · EPSS 0.00248 · Published 2013-11-23 · Fixed CWE-362
