Lucene search
Veracode Vulnerability DatabaseVERACODE:5021HistorySep 07, 2017 - 2:45 a.m.
Symbolic Link Attack
2017-09-0702:45:58
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.0004 Low
EPSS
Percentile
5.1%
instack-undercloud is vulnerable to symbolic link attacks. The library uses a hardcoded temporary files during pre-installation, allowing a malicious user to conduct a symbolic link attack and overwrite arbitrary files.
| CPE | Name | Operator | Version |
|---|---|---|---|
| instack-undercloud | le | 7.4.14 | |
| instack-undercloud | le | 6.1.0 | |
| instack-undercloud | le | 7.4.14 | |
| instack-undercloud | le | 6.1.0 |
References
www.securityfocus.com/bid/100407
access.redhat.com/errata/RHSA-2017:2557
access.redhat.com/errata/RHSA-2017:2649
access.redhat.com/errata/RHSA-2017:2687
access.redhat.com/errata/RHSA-2017:2693
access.redhat.com/errata/RHSA-2017:2726
access.redhat.com/security/cve/CVE-2017-7549
bugzilla.redhat.com/show_bug.cgi?id=1477403
Related
redhat
redhat
(RHSA-2017:2687) Moderate: instack-undercloud security update
2017-09-12 16:18:17
(RHSA-2017:2649) Moderate: instack-undercloud security, bug fix, and enhancement update
2017-09-06 16:37:27
(RHSA-2017:2693) Moderate: instack-undercloud security update
2017-09-12 16:45:06
cvelist
cvelist
CVE-2017-7549
2017-09-21 20:00:00
nvd
nvd
CVE-2017-7549
2017-09-21 21:29:00
nessus
nessus
RHEL 7 : instack-undercloud (RHSA-2017:2649)
2024-04-24 00:00:00
osv
osv
CVE-2017-7549
2017-09-21 21:29:00
instack-undercloud vulnerable to symlink attack on tmp files
2022-05-13 01:07:33
cve
cve
CVE-2017-7549
2017-09-21 21:29:00
redhatcve
redhatcve
CVE-2017-7549
2019-10-05 14:05:43
veracode
veracode
Symbolic Link Attack
2019-01-15 09:19:18
github
github
instack-undercloud vulnerable to symlink attack on tmp files
2022-05-13 01:07:33
prion
prion
Design/Logic Flaw
2017-09-21 21:29:00