CVE-2013-7458 Information

Description

linenoise as used in Redis before 3.2.3 uses world-readable permissions for .rediscli_history which allows local users to obtain sensitive information by reading the file.

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Reference

http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html http://www.debian.org/security/2016/dsa-3634 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460 https://github.com/antirez/linenoise/issues/121 https://github.com/antirez/linenoise/pull/122 https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES https://github.com/antirez/redis/issues/3284 https://github.com/antirez/redis/pull/1418 https://github.com/antirez/redis/pull/3322

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

NONE

Base Score

NONE

Base Severity

3.3