GitHub Advisoryadvisory · PyPI
GHSA-w8gx-hhcx-px6w Openstack tripleo-heat-templates unauthenticated file access
MEDIUM
Official page ↗
- Aliases
- CVE-2017-12155
- Ecosystem
- PyPI
- Packages
- tripleo-heat-templates
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-306
- Reviewed
- 2023-07-26
Affected packages
• PyPI tripleo-heat-templates: < 7.0.6 → fixed in 7.0.6
Description
A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
Related
Alias · CVE (1)
- CVE-2017-12155 A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as… vulnerability
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-12155 advisory
- https://access.redhat.com/errata/RHSA-2018:0602 web
- https://access.redhat.com/errata/RHSA-2018:1593 web
- https://access.redhat.com/errata/RHSA-2018:1627 web
- https://bugs.launchpad.net/tripleo/+bug/1720787 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1489360 web
- https://github.com/openstack/tripleo-heat-templates package
- https://opendev.org/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4 web
- https://opendev.org/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30 web