PT-2018-5110 · Puppet · Puppet-Tripleo

Summer Long · Publicado 2018-04-23 · Atualizado 2021-08-04 · CVE-2016-9599

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions puppet-tripleo versions prior to 5.5.0 puppet-tripleo versions prior to 6.2.0

Description The issue is related to an access-control flaw in the IPtables rules management, which allows the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could potentially use these open ports to gain access to unauthorized resources.

Recommendations For versions prior to 5.5.0, update to version 5.5.0 or later to resolve the issue. For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPtables rules management until a patch is available.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-9599

RHSA-2017:0025

Produtos afetados

Puppet-Tripleo

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9599 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2017-0025.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-9599 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9599 · Nota