PT-2018-7146 · Red Hat · Openstack-Tripleo-Common

Publicado 2018-08-22 · Atualizado 2021-08-04 · CVE-2017-2627

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: openstack-tripleo-common versions as shipped with Red Hat Openstack Enterprise 10 and 11

Description: A flaw was found in the sudoers file installed with the openstack-tripleo-common package. The file is too permissive, containing lines for the mistral user with wildcards that allow directory traversal using '..'. It also grants full passwordless root access to the validations user.

Recommendations: For openstack-tripleo-common versions as shipped with Red Hat Openstack Enterprise 10 and 11, consider restricting the permissions in the sudoers file to prevent directory traversal and limit root access to the validations user. As a temporary workaround, restrict access to the validations user and the mistral user until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-2627

Produtos afetados

Openstack-Tripleo-Common

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-2627 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-2627 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2627 · Aviso do Fabricante