rhsa-2015:2650
Vulnerability from csaf_redhat
Published
2015-12-21 16:44
Modified
2024-11-22 09:35
Summary
Red Hat Security Advisory: Red Hat Enterprise Linux OpenStack Platform 7 director update

Notes

Topic
Updated packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 7.0 director for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Red Hat Enterprise Linux OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud based on Red Hat Enterprise Linux OpenStack Platform. It was discovered that the director's NeutronMetadataProxySharedSecret parameter remained specified at the default value of 'unset'. This value is used by OpenStack Networking to sign instance headers; if unchanged, an attacker knowing the shared secret could use this flaw to spoof OpenStack Networking metadata requests. (CVE-2015-5303) A flaw was found in the director (openstack-tripleo-heat-templates) where the RabbitMQ credentials defaulted to guest/guest and supplied values in the configuration were not used. As a result, all deployed overclouds used the same credentials (guest/guest). A remote, non-authenticated attacker could use this flaw to access RabbitMQ services in the deployed cloud. (CVE-2015-5329) The CVE-2015-5303 issue was discovered by Steven Hardy of Red Hat. Red Hat would like to thank Kota Akatsuka of NEC for reporting the CVE-2015-5329 issue. Additional bug fixes include: * Previously, hard-coded parameters were passed directly to Orchestration (heat). As a result, the parameters could not be overridden properly. With this update, a custom environment file from the parameters collected is generated and pass as 'parameter_defaults', allowing parameters to be overridden.(BZ#1245737) * Previously, when scaling out Compute nodes in the Overcloud after an update was performed, the default UpdateIdentifier parameter in the Orchestration stack caused the new node to attempt an update as soon as it was coming up. Because the yum repositories were not configured on the new nodes yet, this caused the update to fail, which in turn caused the scale out to fail. With this update, the client, python-rdomanager-oscplugin, does not clear the UpdateIdentifier parameter on subsequent stack-update attempts (including the scale out) until after the initial update has been completed. As a result, scale-out attempts after the update now succeed.(BZ#1290796) * Previously, the 'debug' parameter was enabled and hard-coded in the overcloud deployment code, and the user could not disable debugging. With this update, the 'debug' parameter has been removed from default hard-coded parameters in the overcloud deployment code. As a result, the user can now control the debugging level in the environment file used to deploy the overcloud.(BZ#1259084) * Previously, deployment validation checked all OpenStack Bare Metal (ironic) nodes, including ones in maintenance mode (even though these cannot be deployed), which resulted in false errors and warnings. With this update, nodes in maintenance mode are skipped by the validation step and false errors are no longer produced.(BZ#1261863) * Previously, the 'tempest-deployer-input.conf' file contained an incorrect stack_owner_role value, which meant that using this file for post-install validation caused Tempest test failures. With this update, the stack_owner_role value generated during deployment has been changed. As a result, fewer Tempest tests will fail during post-install validation. (BZ#1265714) * Previously, breakpoints were not removed when an update operation failed. If a user ran the "openstack overcloud update" command and it failed, the subsequent stack-update command (for example, "openstack overcloud deploy") could be stuck in the 'IN_PROGRESS' state waiting for the removal of breakpoints. With this update, all existing CLI commands explicitly remove any existing breakpoints when running a stack-update operation, and stack-update operations do not get stuck in the 'IN_PROGRESS' state.(BZ#1267558) All Red Hat Enterprise Linux OpenStack Platform 7.0 director users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated packages that fix two security issues and multiple bugs are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0 director\nfor Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Enterprise Linux OpenStack Platform director provides the\nfacilities for deploying and monitoring a private or public\ninfrastructure-as-a-service (IaaS) cloud based on Red Hat Enterprise\nLinux OpenStack Platform.\n\nIt was discovered that the director\u0027s NeutronMetadataProxySharedSecret\nparameter remained specified at the default value of \u0027unset\u0027. This value\nis used by OpenStack Networking to sign instance headers; if unchanged,\nan attacker knowing the shared secret could use this flaw to spoof\nOpenStack Networking metadata requests. (CVE-2015-5303)\n\nA flaw was found in the director (openstack-tripleo-heat-templates) where\nthe RabbitMQ credentials defaulted to guest/guest and supplied values in\nthe configuration were not used. As a result, all deployed overclouds used\nthe same credentials (guest/guest). A remote, non-authenticated attacker\ncould use this flaw to access RabbitMQ services in the deployed cloud.\n(CVE-2015-5329)\n\nThe CVE-2015-5303 issue was discovered by Steven Hardy of Red Hat.\nRed Hat would like to thank Kota Akatsuka of NEC for reporting the\nCVE-2015-5329 issue.\n\nAdditional bug fixes include:\n\n* Previously, hard-coded parameters were passed directly to Orchestration \n(heat). As a result, the parameters could not be overridden properly. With \nthis update, a custom environment file from the parameters collected is \ngenerated and pass as \u0027parameter_defaults\u0027, allowing parameters to be \noverridden.(BZ#1245737)\n\n* Previously, when scaling out Compute nodes in the Overcloud after\nan update was performed, the default UpdateIdentifier parameter in the\nOrchestration stack caused the new node to attempt an update \nas soon as it was coming up. Because the yum repositories were not \nconfigured on the new nodes yet, this caused the update to fail,\nwhich in turn caused the scale out to fail. With this update, the\nclient, python-rdomanager-oscplugin, does not clear the UpdateIdentifier\nparameter on subsequent stack-update attempts (including the scale out)\nuntil after the initial update has been completed. As a result, scale-out\nattempts after the update now succeed.(BZ#1290796)\n\n* Previously, the \u0027debug\u0027 parameter was enabled and hard-coded in the\novercloud deployment code, and the user could not disable debugging. \nWith this update, the \u0027debug\u0027 parameter has been removed from default \nhard-coded parameters in the overcloud deployment code. As a result, \nthe user can now control the debugging level in the environment file\nused to deploy the overcloud.(BZ#1259084)\n\n* Previously, deployment validation checked all OpenStack Bare Metal \n(ironic) nodes, including ones in maintenance mode (even though these\ncannot be deployed), which resulted in false errors and warnings. \nWith this update, nodes in maintenance mode are skipped by the\nvalidation step and false errors are no longer produced.(BZ#1261863)\n\n* Previously, the \u0027tempest-deployer-input.conf\u0027 file contained an\nincorrect stack_owner_role value, which meant that using this file for \npost-install validation caused Tempest test failures. With this update,\nthe stack_owner_role value generated during deployment has been changed.\nAs a result, fewer Tempest tests will fail during post-install validation.\n(BZ#1265714)\n\n* Previously, breakpoints were not removed when an update operation\nfailed. If a user ran the \"openstack overcloud update\" command and it\nfailed, the subsequent stack-update command (for example, \"openstack \novercloud deploy\") could be stuck in the \u0027IN_PROGRESS\u0027 state waiting for the \nremoval of breakpoints. With this update, all existing CLI commands \nexplicitly remove any existing breakpoints when running a stack-update \noperation, and stack-update operations do not get stuck in the \u0027IN_PROGRESS\u0027 \nstate.(BZ#1267558)\n\nAll Red Hat Enterprise Linux OpenStack Platform 7.0 director users are\nadvised to upgrade to these updated packages, which correct these issues\nand add these enhancements.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2650",
        "url": "https://access.redhat.com/errata/RHSA-2015:2650"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-enterprise-linux-openstack-platform/version-7/release-notes",
        "url": "https://access.redhat.com/documentation/en/red-hat-enterprise-linux-openstack-platform/version-7/release-notes"
      },
      {
        "category": "external",
        "summary": "1231885",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1231885"
      },
      {
        "category": "external",
        "summary": "1241434",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1241434"
      },
      {
        "category": "external",
        "summary": "1245737",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1245737"
      },
      {
        "category": "external",
        "summary": "1252083",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1252083"
      },
      {
        "category": "external",
        "summary": "1259084",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1259084"
      },
      {
        "category": "external",
        "summary": "1260776",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1260776"
      },
      {
        "category": "external",
        "summary": "1261863",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1261863"
      },
      {
        "category": "external",
        "summary": "1262425",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1262425"
      },
      {
        "category": "external",
        "summary": "1265714",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265714"
      },
      {
        "category": "external",
        "summary": "1266910",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1266910"
      },
      {
        "category": "external",
        "summary": "1267558",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1267558"
      },
      {
        "category": "external",
        "summary": "1267855",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1267855"
      },
      {
        "category": "external",
        "summary": "1268415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1268415"
      },
      {
        "category": "external",
        "summary": "1271692",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1271692"
      },
      {
        "category": "external",
        "summary": "1272297",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1272297"
      },
      {
        "category": "external",
        "summary": "1272347",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1272347"
      },
      {
        "category": "external",
        "summary": "1272357",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1272357"
      },
      {
        "category": "external",
        "summary": "1275324",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1275324"
      },
      {
        "category": "external",
        "summary": "1275812",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1275812"
      },
      {
        "category": "external",
        "summary": "1281460",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281460"
      },
      {
        "category": "external",
        "summary": "1281777",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281777"
      },
      {
        "category": "external",
        "summary": "1284914",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1284914"
      },
      {
        "category": "external",
        "summary": "1285079",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1285079"
      },
      {
        "category": "external",
        "summary": "1285363",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1285363"
      },
      {
        "category": "external",
        "summary": "1285485",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1285485"
      },
      {
        "category": "external",
        "summary": "1287624",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1287624"
      },
      {
        "category": "external",
        "summary": "1290582",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290582"
      },
      {
        "category": "external",
        "summary": "1290796",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290796"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2650.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Enterprise Linux OpenStack Platform 7 director update",
    "tracking": {
      "current_release_date": "2024-11-22T09:35:03+00:00",
      "generator": {
        "date": "2024-11-22T09:35:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2015:2650",
      "initial_release_date": "2015-12-21T16:44:54+00:00",
      "revision_history": [
        {
          "date": "2015-12-21T16:44:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-12-21T16:44:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T09:35:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenStack 7.0 Director for RHEL 7",
                "product": {
                  "name": "OpenStack 7.0 Director for RHEL 7",
                  "product_id": "7Server-RH7-RHOS-7.0-Director",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack-director:7::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
                "product": {
                  "name": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
                  "product_id": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-rdomanager-oscplugin@0.0.10-22.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
                "product": {
                  "name": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
                  "product_id": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-tripleo-heat-templates@0.8.6-94.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src",
                "product": {
                  "name": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src",
                  "product_id": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-rdomanager-oscplugin@0.0.10-22.el7ost?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
                "product": {
                  "name": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
                  "product_id": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-tripleo-heat-templates@0.8.6-94.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch as a component of OpenStack 7.0 Director for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch"
        },
        "product_reference": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0-Director"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src as a component of OpenStack 7.0 Director for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src"
        },
        "product_reference": "openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0-Director"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch as a component of OpenStack 7.0 Director for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch"
        },
        "product_reference": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0-Director"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src as a component of OpenStack 7.0 Director for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
        },
        "product_reference": "python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0-Director"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Steven Hardy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2015-5303",
      "discovery_date": "2015-10-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1272297"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that Director\u0027s NeutronMetadataProxySharedSecret parameter remained specified at the default value of \u0027unset\u0027. This value is used by OpenStack Networking to sign instance headers; if unchanged, an attacker knowing the shared secret could use this flaw to spoof OpenStack Networking metadata requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-rdomanager-oscplugin: NeutronMetadataProxySharedSecret parameter uses default value",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
          "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
          "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
          "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5303"
        },
        {
          "category": "external",
          "summary": "RHBZ#1272297",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1272297"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5303",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5303"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5303",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5303"
        }
      ],
      "release_date": "2015-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-21T16:44:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2650"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-rdomanager-oscplugin: NeutronMetadataProxySharedSecret parameter uses default value"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Kota Akatsuka"
          ],
          "organization": "NEC"
        }
      ],
      "cve": "CVE-2015-5329",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "discovery_date": "2015-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1281777"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the director (openstack-tripleo-heat-templates) where the RabbitMQ credentials defaulted to guest/guest and supplied values in the configuration were not used. As a result, all deployed overclouds used the same credentials (guest/guest). A remote non-authenticated attacker could use this flaw to access RabbitMQ services in the deployed cloud.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-tripleo-heat-templates: Using hardcoded rabbitmq credentials regardless of supplied values",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
          "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
          "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
          "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5329"
        },
        {
          "category": "external",
          "summary": "RHBZ#1281777",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281777"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5329",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5329"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5329",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5329"
        }
      ],
      "release_date": "2015-11-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-21T16:44:54+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2650"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:openstack-tripleo-heat-templates-0:0.8.6-94.el7ost.src",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.noarch",
            "7Server-RH7-RHOS-7.0-Director:python-rdomanager-oscplugin-0:0.0.10-22.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-tripleo-heat-templates: Using hardcoded rabbitmq credentials regardless of supplied values"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.