Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

mantis: database credentials leak

Package(s):

mantis

CVE #(s):

Created:

August 10, 2009

Updated:

August 12, 2009

Description:

From the Debian advisory:

It was discovered that the Debian Mantis package, a web based bug tracking system, installed the database credentials in a file with world-readable permissions onto the local filesystem. This allows local users to acquire the credentials used to control the Mantis database.

Alerts:

Debian

DSA-1856-1

2009-08-08

(Log in to post comments)