PT-2023-8846 · Openstack · Openstack Designate

Michael Johnson + 1 · Publicado 2023-11-11 · Atualizado 2026-01-21 · CVE-2023-6725

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Designate (affected versions not specified)

Description An access-control flaw was found in the OpenStack Designate component where private configuration information, including access keys to BIND, were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information. The flaw is related to insufficient access control when handling the /etc/designate/private and /etc/designate/private/bind1.conf files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-1220

CWE-264

Identificadores relacionados

BDU:2024-02285

CVE-2023-6725

RHSA-2024:2736

RHSA-2024:2770

Produtos afetados

Openstack Designate

Referências · 14

• https://t.me/cvenotify/80790 · Publicação no Telegram
• https://bugzilla.redhat.com/show_bug.cgi?id=2249273 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-6725 · Aviso do Fabricante
• https://t.me/cvenotify/73922 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1768649908138004755 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-6725 · Aviso do Fabricante
• https://t.me/cvenotify/73950 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1768620175480529084 · Publicação no Twitter
• https://access.redhat.com/documentation/ru-ru/red_hat_openstack_platform/17.0/html/using_designate_for_dns-as-a-service/index · Nota
• https://bdu.fstec.ru/vul/2024-02285 · Nota de Segurança
• https://t.me/cveNotify/149378 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-6725 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2024:2736 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2024:2770 · Aviso do Fabricante