CVE-2015-4166 Other in n/a
Attackers may cause loss of encryption keys due to asynchronous storage, potentially compromising data confidentiality in Cloudera Key Trustee Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-4166?
CVE-2015-4166 is a critical vulnerability in n/a, published on 23 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
Weakness: CWE-320
Which versions are affected by CVE-2015-4166?
It affects 1 product.
Products include Cloudera Key Trustee Server.
How do I fix CVE-2015-4166?
No fix has been published for CVE-2015-4166 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-4166 being exploited?
There is no known exploitation of CVE-2015-4166 in the wild and no public exploit code.
Sources
Also known as GHSA-p2c6-q8wg-x69m.