CVE-2023-6725 Tripleo-ansible: bind keys are world readable

2024-03-1512:38:23

CWE-1220

redhat

www.cve.org

cve-2023-6725

tripleo-ansible

openstack designate

access control

world readable

bind

sensitive information

CVSS3

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

AI Score

6.4

Confidence

High

EPSS

Percentile

15.5%

JSON

An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-tripleo-heat-templates",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:14.3.1-17.1.20231103003762.el8ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "tripleo-ansible",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.3.1-17.1.20231101233754.el8ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-tripleo-heat-templates",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:14.3.1-17.1.20231103010840.el9ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "tripleo-ansible",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.3.1-17.1.20231101230831.el9ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-designate",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:openstack:16.1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-designate",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:openstack:16.2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-designate",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openstack:17.1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 18.0",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openstack-designate",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:openstack:18.0"
    ]
  }
]