PT-2016-5967 · Red Hat · Red Hat Enterprise Linux Openstack Platform+1

David Patterson · Published 2016-06-30 · Updated 2021-08-04 · CVE-2016-4474

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat OpenStack Platform versions 8.0 (Liberty) Red Hat Enterprise Linux OpenStack Platform version 7.0 (Kilo)

Description The image build process for the overcloud images in the affected platforms uses a default root password of ROOTPW, allowing attackers to gain access via unspecified vectors.

Recommendations For Red Hat OpenStack Platform version 8.0 (Liberty), change the default root password to a secure password. For Red Hat Enterprise Linux OpenStack Platform version 7.0 (Kilo), change the default root password to a secure password. As a temporary workaround, consider restricting access to the overcloud images until a secure root password is set.

Fix

Information Disclosure

Weakness Enumeration

CWE-254

CWE-200

Related Identifiers

CVE-2016-4474

RHSA-2016:1222

Affected Products

Red Hat Enterprise Linux Openstack Platform

Red Hat Openstack Platform

References · 6

• https://osv.dev/vulnerability/CVE-2016-4474 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1222.html · Vendor Advisory
• https://access.redhat.com/security/vulnerabilities/2359821 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2016-1223.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4474 · Security Note
• https://t.me/cvenotify/18655 · Telegram Post