PT-2022-11485 · Openstack · Openstack-Tripleo-Heat-Templates

Guilherme De Almeida Suckevicz · Published 2022-03-23 · Updated 2022-07-25 · CVE-2021-4180

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions openstack-tripleo-heat-templates versions prior to 11.6.1

Description An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www authenticate uri parameter in configuration files, which is visible to all end users. This would give sensitive information that may aid in additional system exploitation.

Recommendations For versions prior to 11.6.1, update to version 11.6.1 or apply the patch available on the master branch to resolve the issue. As a temporary workaround, consider restricting access to configuration files that contain the www authenticate uri parameter to minimize the risk of exploitation.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2021-4180

GHSA-HM3X-JWWF-JPR9

RHSA-2022:0995

RHSA-2022:8796

Affected Products

Openstack-Tripleo-Heat-Templates

References · 12

• https://osv.dev/vulnerability/CVE-2021-4180 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2035793 · Patch
• https://osv.dev/vulnerability/GHSA-hm3x-jwwf-jpr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4180 · Security Note
• https://ubuntu.com/security/CVE-2021-4180 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4180 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4180 · Vendor Advisory
• https://github.com/openstack/tripleo-heat-templates/commit/160936df134a471cfd245bd60964046027a571ea · Note
• https://github.com/openstack/tripleo-heat-templates · Note
• https://github.com/openstack/tripleo-heat-templates/commit/2b9461e97fc5c4ceb0848d1cc4484f656bb85515 · Note
• https://bugs.launchpad.net/tripleo/+bug/1955397 · Note
• https://t.me/cibsecurity/39451 · Telegram Post