PT-2017-17793 · Red Hat · Instack-Undercloud

Matthew Booth + 1 · Publicado 2017-09-21 · Atualizado 2023-02-12 · CVE-2017-7549

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions instack-undercloud versions 5.3.0 through 7.2.0

Description A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure temporary files. This could allow a local user to conduct a symbolic-link attack, enabling them to overwrite the contents of arbitrary files.

Recommendations For instack-undercloud version 5.3.0, consider restricting access to temporary files used by pre-install and security policy scripts until a patch is available. For instack-undercloud version 6.1.0, restrict access to temporary files used by pre-install and security policy scripts until a patch is available. For instack-undercloud version 7.2.0, restrict access to temporary files used by pre-install and security policy scripts until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

CWE-377

Identificadores relacionados

CVE-2017-7549

GHSA-53WM-97P6-582F

PYSEC-2017-152

RHSA-2017:2557

RHSA-2017:2649

RHSA-2017:2687

RHSA-2017:2693

RHSA-2017:2726

Produtos afetados

Instack-Undercloud

Referências · 15

• https://github.com/pypa/advisory-database/tree/main/vulns/instack/PYSEC-2017-152.yaml · Nota
• https://access.redhat.com/errata/RHSA-2017:2649 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2687 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1477403 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2557 · Aviso do Fabricante
• http://securityfocus.com/bid/100407 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7549 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:2726 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2693 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-152 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2017-7549 · Nota
• https://osv.dev/vulnerability/GHSA-53wm-97p6-582f · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7549 · Aviso do Fabricante
• https://opendev.org/openstack/instack-undercloud · Nota
• https://web.archive.org/web/20170907040549/http://securityfocus.com/bid/100407 · Nota