PT-2023-8846 · Openstack · Openstack Designate

Michael Johnson + 1 · Published 2023-11-11 · Updated 2026-01-21 · CVE-2023-6725

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Designate (affected versions not specified)

Description An access-control flaw was found in the OpenStack Designate component where private configuration information, including access keys to BIND, were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information. The flaw is related to insufficient access control when handling the /etc/designate/private and /etc/designate/private/bind1.conf files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1220

CWE-264

Related Identifiers

BDU:2024-02285

CVE-2023-6725

RHSA-2024:2736

RHSA-2024:2770

Affected Products

Openstack Designate

References · 14

• https://bugzilla.redhat.com/show_bug.cgi?id=2249273 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-6725 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6725 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02285 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6725 · Security Note
• https://access.redhat.com/errata/RHSA-2024:2736 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:2770 · Vendor Advisory
• https://t.me/cvenotify/80790 · Telegram Post
• https://t.me/cvenotify/73922 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1768649908138004755 · Twitter Post
• https://t.me/cvenotify/73950 · Telegram Post
• https://twitter.com/CVEnew/status/1768620175480529084 · Twitter Post
• https://access.redhat.com/documentation/ru-ru/red_hat_openstack_platform/17.0/html/using_designate_for_dns-as-a-service/index · Note
• https://t.me/cveNotify/149378 · Telegram Post