CVE-2015-8559

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/12/14/14Mailing List, Third Party Advisory
https://discourse.chef.io/t/chef-infra-client-15-4-45-released/16081
https://github.com/chef/chef/issues/3871Patch, Third Party Advisory
https://github.com/chef/chef/pull/8885
http://www.openwall.com/lists/oss-security/2015/12/14/14Mailing List, Third Party Advisory
https://discourse.chef.io/t/chef-infra-client-15-4-45-released/16081
https://github.com/chef/chef/issues/3871Patch, Third Party Advisory
https://github.com/chef/chef/pull/8885

Timeline

Published: Sep 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-85607.3Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x a CVE-2015-85616.8The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or CVE-2015-85627.5Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via t CVE-2015-85636.8Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows CVE-2015-85647.5Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal s CVE-2015-85657.5Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact v CVE-2015-85667.5The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.CVE-2015-85677.7Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).CVE-2015-85686.5Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of servic CVE-2015-85692.3The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length CVE-2015-85707.4The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user p CVE-2015-85716.8Integer overflow in Autodesk Design Review (ADR) before 2013 Hotfix 2 allows remote attackers to execute arbitrary code via a crafted biClrU