Moderate: Red Hat Security Advisory: openstack-tripleo-common and openstack-tripleo-heat-templates update

An update for openstack-tripleo-common and openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2017-12155

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack...

CVE-2017-12155: Missing Authentication for Critical Function

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack...

PT-2017-12370

Name of the Vulnerable Software and Affected Versions openstack-tripleo-heat-templates versions prior to 7.0.6 openstack-tripleo-heat-templates versions prior to 8.0.0 Description A resource-permission flaw was found in the openstack-tripleo-heat-templates package where...

Design/Logic Flaw

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...

CVE-2016-2102

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...

CVE-2016-2102

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...

CVE-2016-2102

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...

CVE-2016-2102

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...

PT-2017-7997

Name of the Vulnerable Software and Affected Versions openstack-tripleo-image-elements affected versions not specified Description The issue concerns HAProxy statistics in openstack-tripleo-image-elements being transmitted over the network without authentication. Recommendations At the moment,...

CVE-2016-2102: Improper Authentication

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network...

OpenStack tripleo-common insecure file permissions vulnerability

OpenStack tripleo-common is a Python library for common code for the TripleO CLI and TripleO UI. OpenStack tripleo-common is vulnerable to an insecure file permission vulnerability. A local attacker can exploit this vulnerability to cause directory traversal and gain root access to the shadowed...

CVE-2017-2627

A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal...

openstack-tripleo-heat-templates: unsafe pipeline ordering of swift staticweb middleware

A flaw was discovered in the pipeline ordering of OpenStack Object Storage's staticweb middleware in the swiftproxy configuration generated from the openstack-tripleo-heat-templates package OpenStack director. The staticweb middleware was incorrectly configured before the Identity Service, and...