CVE-2023-6725

2024-03-1500:00:00

ubuntu.com

openstack designate

access control

private configuration

access keys

world readable

bind

unauthorized access

inadequate security

CVSS3

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

AI Score

6.2

Confidence

High

EPSS

Percentile

15.5%

JSON

An access-control flaw was found in the OpenStack Designate component where
private configuration information including access keys to BIND were
improperly made world readable. A malicious attacker with access to any
container could exploit this flaw to access sensitive information.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=2249273>

Notes

Author	Note
mdeslaur	In Ubuntu, the /etc/designate directory isn’t world-readable, so this likely isn’t an issue. Deferring this CVE until we get more information.
yomonokio	The issue is specific to RH OpenStack Platform packaging