CVE-2022-3596
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat OpenStack Platform 13.0 - ELS | 0:8.4.9-13.el7ost < * | unaffected |
| Red Hat | Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS | 0:8.4.9-13.el7ost < * | unaffected |
Weaknesses
- CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
Workarounds
The rsync daemon is no longer needed and can be manually disabled by running the following commands on the undercloud:
sudo rm /etc/xinetd.d/rsync /etc/rsyncd.conf
sudo systemctl restart xinetd
However, this will be reverted if the undercloud gets updated.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://access.redhat.com/errata/RHSA-2022:8897
- https://access.redhat.com/security/cve/CVE-2022-3596
- https://bugzilla.redhat.com/show_bug.cgi?id=2136596
References
- https://access.redhat.com/errata/RHSA-2022:8897
- https://access.redhat.com/security/cve/CVE-2022-3596
- https://bugzilla.redhat.com/show_bug.cgi?id=2136596
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.