PT-2017-17793 · Red Hat · Instack-Undercloud

Matthew Booth + 1 · Published 2017-09-21 · Updated 2023-02-12 · CVE-2017-7549

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions instack-undercloud versions 5.3.0 through 7.2.0

Description A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure temporary files. This could allow a local user to conduct a symbolic-link attack, enabling them to overwrite the contents of arbitrary files.

Recommendations For instack-undercloud version 5.3.0, consider restricting access to temporary files used by pre-install and security policy scripts until a patch is available. For instack-undercloud version 6.1.0, restrict access to temporary files used by pre-install and security policy scripts until a patch is available. For instack-undercloud version 7.2.0, restrict access to temporary files used by pre-install and security policy scripts until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-377

Related Identifiers

CVE-2017-7549

GHSA-53WM-97P6-582F

PYSEC-2017-152

RHSA-2017:2557

RHSA-2017:2649

RHSA-2017:2687

RHSA-2017:2693

RHSA-2017:2726

Affected Products

Instack-Undercloud

References · 15

• https://access.redhat.com/errata/RHSA-2017:2649 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2687 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1477403 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7549 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2726 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2693 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-152 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-53wm-97p6-582f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7549 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/instack/PYSEC-2017-152.yaml · Note
• http://securityfocus.com/bid/100407 · Note
• https://access.redhat.com/security/cve/CVE-2017-7549 · Note
• https://opendev.org/openstack/instack-undercloud · Note
• https://web.archive.org/web/20170907040549/http://securityfocus.com/bid/100407 · Note