Bug 2132541 (CVE-2022-3276)

Summary:	CVE-2022-3276 Puppetlabs-mysql: Command Injection in the puppetlabs-mysql module
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	eglynn, jjoyce, jschluet, lhh, mburns, mgarciac, rhos-maint, slinaber, spower, tvignaud, ytale
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Puppetlabs-mysql 13.0.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was in the puppetlabs-mysql module, where a Command injection can occur. This flaw allows a malicious actor to provide unsanitized input to the module.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-02 21:33:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2132542, 2132577, 2132578, 2132579, 2132580
Bug Blocks:	2132124

Description Avinash Hanwate 2022-10-06 05:01:30 UTC

Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.

Ref: https://puppet.com/security/cve/CVE-2022-3276

Comment 1 Avinash Hanwate 2022-10-06 05:01:52 UTC

Created puppet-mysql tracking bugs for this issue:

Affects: openstack-rdo [bug 2132542]

Comment 9 errata-xmlrpc 2022-10-27 09:02:42 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.0
  Red Hat OpenStack Platform 13.0 - ELS
  Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS
  Red Hat OpenStack Platform 16.1
  Red Hat OpenStack Platform 16.2

Via RHSA-2022:7238 https://access.redhat.com/errata/RHSA-2022:7238

Comment 10 Product Security DevOps Team 2022-12-02 21:33:18 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3276