CVE-2020-14156
published 2020-06-15CVE-2020-14156: user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
PriorityP344high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.81%
75.9th percentile
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbmc-project | openbmc | < 2020-04-03 | 2020-04-03 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/openbmc/openbmc/issues/3670https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.htmlhttps://github.com/openbmc/openbmc/issues/3670https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html
2020-06-15
Published