PT-2017-12370 · Openstack · Openstack-Tripleo-Heat-Templates

Adam Mariš + 1 · Publicado 2017-12-12 · Atualizado 2022-05-13 · CVE-2017-12155

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions openstack-tripleo-heat-templates versions prior to 7.0.6 openstack-tripleo-heat-templates versions prior to 8.0.0

Description A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

Recommendations For openstack-tripleo-heat-templates versions prior to 7.0.6, update to version 7.0.6 or later to resolve the issue. For openstack-tripleo-heat-templates versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2017-12155

GHSA-W8GX-HHCX-PX6W

RHSA-2018:0602

RHSA-2018:1593

RHSA-2018:1627

Produtos afetados

Openstack-Tripleo-Heat-Templates

Referências · 13

• https://github.com/openstack/tripleo-heat-templates · Nota
• https://ubuntu.com/security/CVE-2017-12155 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12155 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w8gx-hhcx-px6w · Aviso do Fabricante
• https://opendev.org/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30 · Nota
• https://access.redhat.com/errata/RHSA-2018:1627 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12155 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:1593 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12155 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:0602 · Aviso do Fabricante
• https://opendev.org/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4 · Nota
• https://bugs.launchpad.net/tripleo/+bug/1720787 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=1489360 · Nota