CVE:CVE-2014-0135
CNNVD:CNNVD-201405-185
Foreman是一套用于物理和虚拟服务器中的生命周期管理工具。该工具提供服务开通、配置管理以及报告状态等功能。Kafo是一套用于制作基于Puppet（配置管理工具）用户友好安装的应用。
Foreman使用的Kafo 0.3.16及之前的版本和0.5.2之前的0.4.x版本中存在安全漏洞，该漏洞源于程序对default_values.yaml文件使用全局可读权限。本地攻击者可通过读取文件利用该漏洞获取密码和其他敏感消息。
solution:Upgrade theforeman kafo to a higher version than 0.3.16,0.0.1,0.0.2,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7,0.0.8,0.0.9,0.0.10,0.0.11,0.0.12,0.0.13,0.0.14,0.0.15,0.0.16,0.0.17,0.1.0,0.2.0,0.2.1,0.2.2,0.3.0,0.3.1,0.3.2,0.3.3,0.3.4,0.3.5,0.3.6,0.3.7,0.3.8,0.3.9,0.3.10,0.3.11,0.3.12,0.3.13,0.3.14,0.3.15,0.4.0,0.5.0,0.5.1,and avoid the version (,0.3.16],0.0.1,0.0.2,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7,0.0.8,0.0.9,0.0.10,0.0.11,0.0.12,0.0.13,0.0.14,0.0.15,0.0.16,0.0.17,0.1.0,0.2.0,0.2.1,0.2.2,0.3.0,0.3.1,0.3.2,0.3.3,0.3.4,0.3.5,0.3.6,0.3.7,0.3.8,0.3.9,0.3.10,0.3.11,0.3.12,0.3.13,0.3.14,0.3.15,0.4.0,0.5.0,0.5.1