CVE-2015-7944

The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.

• CWE-399

• http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.htmlPatch, Third Party Advisory, VDB Entry
• http://www.debian.org/security/2016/dsa-3431
• http://www.ocert.org/advisories/ocert-2015-012.htmlPatch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/39169/
• http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.13/html/news.html#version-2-13-3Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.14/html/news.html#version-2-14-2Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.15/html/news.html#version-2-15-2Release Notes, Vendor Advisory
• http://docs.ganeti.org/ganeti/2.9/html/news.html#version-2-9-7Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/135101/Ganeti-Leaked-Secret-Denial-Of-Service.htmlPatch, Third Party Advisory, VDB Entry
• http://www.debian.org/security/2016/dsa-3431
• http://www.ocert.org/advisories/ocert-2015-012.htmlPatch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/39169/

Published

Aug 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7938Advantech EKI-132x devices with firmware before 2015-12-31 a…
• CVE-2015-7939Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE …
• CVE-2015-7940The Bouncy Castle Java library before 1.51 does not validate…
• CVE-2015-7941libxml2 2.9.2 does not properly stop parsing invalid input, …
• CVE-2015-7942The xmlParseConditionalSections function in parser.c in libx…
• CVE-2015-7943Open redirect vulnerability in the Overlay module in Drupal …
• CVE-2015-7945The RESTful control interface (aka RAPI or ganeti-rapi) in G…
• CVE-2015-7946Information Exposure vulnerability in Unity8 as used on the …4.6
• CVE-2015-7947Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-7948Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-7949Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-7950Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…