PT-2018-7146 · Red Hat · Openstack-Tripleo-Common

Published 2018-08-22 · Updated 2021-08-04 · CVE-2017-2627

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: openstack-tripleo-common versions as shipped with Red Hat Openstack Enterprise 10 and 11

Description: A flaw was found in the sudoers file installed with the openstack-tripleo-common package. The file is too permissive, containing lines for the mistral user with wildcards that allow directory traversal using '..'. It also grants full passwordless root access to the validations user.

Recommendations: For openstack-tripleo-common versions as shipped with Red Hat Openstack Enterprise 10 and 11, consider restricting the permissions in the sudoers file to prevent directory traversal and limit root access to the validations user. As a temporary workaround, restrict access to the validations user and the mistral user until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-2627

Affected Products

Openstack-Tripleo-Common

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-2627 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2627 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2627 · Vendor Advisory