PT-2022-24179 · Openstack · Openstack Kolla

Brian Scott + 1 · Published 2022-12-21 · Updated 2023-07-21 · CVE-2022-38060

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Kolla git master 05194e7618

Description A privilege escalation issue exists in the sudo functionality. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.

Recommendations For OpenStack Kolla git master 05194e7618, ensure proper configuration of /etc/sudoers within containers to prevent privilege escalation. As a temporary workaround, consider restricting access to the sudo functionality until a proper configuration can be implemented.

Fix

Improper Privilege Management

Untrusted Search Path

Weakness Enumeration

CWE-269

CWE-426

Related Identifiers

CVE-2022-38060

GHSA-RVXR-PF5F-J2QJ

RHSA-2024:0191

RHSA-2024:0216

Affected Products

Openstack Kolla

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-38060 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38060 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvxr-pf5f-j2qj · Vendor Advisory
• https://github.com/openstack/kolla/commit/2a4a8fce31c12114e8f472c24dd96864b5bd2bd2 · Note
• https://github.com/openstack/kolla · Note
• https://t.me/cvenotify/40319 · Telegram Post
• https://t.me/cibsecurity/55048 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1589 · Note
• https://bugs.launchpad.net/kolla/+bug/1985784 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2124758 · Note