Bug 2136596 (CVE-2022-3596) - CVE-2022-3596 instack-undercloud: rsync leaks information to undercloud
Summary: CVE-2022-3596 instack-undercloud: rsync leaks information to undercloud
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-3596
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2131972
Blocks: 2132112
TreeView+ depends on / blocked
 
Reported: 2022-10-20 18:25 UTC by Nick Tait
Modified: 2023-11-10 16:53 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.
Clone Of:
Environment:
Last Closed: 2022-12-10 10:33:00 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:8897 0 None None None 2022-12-08 10:54:07 UTC

Description Nick Tait 2022-10-20 18:25:44 UTC 
An an information leak was discovered in OpenStack's undercloud. Rsync stores sensitive swift data (for example administrative credentials to the overcloud) in a manner that makes this information visible to local users of the undercloud. This enables potentially anyone with network access to the undercloud to further gain access to the rest of an OpenStack deployment.
Comment 3 errata-xmlrpc 2022-12-08 10:54:06 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 - ELS
  Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

Via RHSA-2022:8897 https://access.redhat.com/errata/RHSA-2022:8897
Comment 4 Product Security DevOps Team 2022-12-10 10:32:58 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3596
Note You need to log in before you can comment on or make changes to this bug.