PT-2016-7127 · Openstack · Openstack+1

Marcus Meissner · Published 2016-12-08 · Updated 2020-09-09 · CVE-2016-6829

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openstack deployment (aka crowbar-openstack) (affected versions not specified) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) (affected versions not specified)

Description The issue concerns a default password for the trove service user in Openstack deployment and Trove Barclamp, making it easier for remote attackers to gain access.

Recommendations For Openstack deployment, change the default password of the trove service user to a strong and unique password. For Trove Barclamp, update the configuration to use a secure password for the trove service user instead of the default one.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2016-6829

SUSE-SU-2016:3056-1

Affected Products

Openstack

Trove Barclamp

References · 12

• https://github.com/crowbar/crowbar-openstack/commit/208230bdfbcb19d062149d083b1a66b429516a69 · Patch
• https://github.com/crowbar/barclamp-trove/commit/932298f250365fed6963700870e52db3a7a32daa · Patch
• https://suse.com/security/cve//CVE-2016-6829.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3056-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6829 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6829 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/08/16/1 · Note
• https://suse.com/support/update/announcement/2016/suse-su-20163056-1 · Note
• http://openwall.com/lists/oss-security/2016/08/18/9 · Note
• http://securityfocus.com/bid/92476 · Note
• https://bugzilla.suse.com/991729 · Note
• https://suse.com/security/cve/CVE-2016-6829 · Note