Bug 2071567 (CVE-2022-0675)
| Summary: | CVE-2022-0675 puppetlabs-firewall: unmanaged rules could leave system in an unsafe state via duplicate comment | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Avinash Hanwate <ahanwate> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | cmuresan, eglynn, jjoyce, jschluet, lhh, mburns, rhos-maint, rkeshri, slinaber, spower, tvignaud, ytale |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Puppet Firewall Module 3.4.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the Puppet Firewall module. In certain situations, an unmanaged rule can exist on the target system that has the same comment as a rule specified in the manifest. When this condition is true, Puppet will ignore the unmanaged rule and continue to apply the rule in the manifest. This issue occurs because the firewall module uses the comment field in IPT as its namevar and therefore expects it to be a unique identifier. In the case of IPT, this is not true, given that you can have multiple rules with the same comment.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-06-22 20:37:18 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2071568, 2071569, 2071572, 2102637 | ||
| Bug Blocks: | 2067016, 2071571 | ||
|
Description
Avinash Hanwate
2022-04-04 08:53:47 UTC
Created puppet-firewall tracking bugs for this issue: Affects: openstack-rdo [bug 2071568] *** Bug 2067017 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat OpenStack Platform 16.2 Via RHSA-2022:5116 https://access.redhat.com/errata/RHSA-2022:5116 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0675 This issue has been addressed in the following products: Red Hat OpenStack Platform 16.1 Via RHSA-2022:8869 https://access.redhat.com/errata/RHSA-2022:8869 |