PT-2018-5110 · Puppet · Puppet-Tripleo

Summer Long · Published 2018-04-23 · Updated 2021-08-04 · CVE-2016-9599

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions puppet-tripleo versions prior to 5.5.0 puppet-tripleo versions prior to 6.2.0

Description The issue is related to an access-control flaw in the IPtables rules management, which allows the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could potentially use these open ports to gain access to unauthorized resources.

Recommendations For versions prior to 5.5.0, update to version 5.5.0 or later to resolve the issue. For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPtables rules management until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-9599

RHSA-2017:0025

Affected Products

Puppet-Tripleo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9599 · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9599 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9599 · Note