Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS by Red Hat
CVE-2022-3596 (GCVE-0-2022-3596)
Vulnerability from nvd – Published: 2023-09-20 19:06 – Updated: 2024-08-03 01:14
VLAI
EPSS
VEX
Title
Instack-undercloud: rsync leaks information to undercloud
Summary
An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2022:8897 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2022-3596 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2136596 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat OpenStack Platform 13.0 - ELS |
Unaffected:
0:8.4.9-13.el7ost , < *
(rpm)
cpe:/a:redhat:openstack:13::el7 |
|
| Red Hat | Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS |
Unaffected:
0:8.4.9-13.el7ost , < *
(rpm)
cpe:/a:redhat:openstack:13::el7 |
Date Public
2022-12-05 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T19:52:27.052407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:15:32.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:14:02.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2022:8897",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2022:8897"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2022-3596"
},
{
"name": "RHBZ#2136596",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136596"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:13::el7"
],
"defaultStatus": "affected",
"packageName": "instack-undercloud",
"product": "Red Hat OpenStack Platform 13.0 - ELS",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.4.9-13.el7ost",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:13::el7"
],
"defaultStatus": "affected",
"packageName": "instack-undercloud",
"product": "Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.4.9-13.el7ost",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Maciej Relewicz (Juniper Networks) for reporting this issue."
}
],
"datePublic": "2022-12-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An information leak was found in OpenStack\u0027s undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-402",
"description": "Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T15:32:25.112Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2022:8897",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2022:8897"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2022-3596"
},
{
"name": "RHBZ#2136596",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136596"
}
],
"timeline": [
{
"lang": "en",
"time": "2022-10-04T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2022-12-05T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Instack-undercloud: rsync leaks information to undercloud",
"workarounds": [
{
"lang": "en",
"value": "The rsync daemon is no longer needed and can be manually disabled by running the following commands on the undercloud:\n\n sudo rm /etc/xinetd.d/rsync /etc/rsyncd.conf \n sudo systemctl restart xinetd\n\nHowever, this will be reverted if the undercloud gets updated."
}
],
"x_redhatCweChain": "CWE-402: Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2022-3596",
"datePublished": "2023-09-20T19:06:28.487Z",
"dateReserved": "2022-10-18T23:34:01.540Z",
"dateUpdated": "2024-08-03T01:14:02.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3596 (GCVE-0-2022-3596)
Vulnerability from cvelistv5 – Published: 2023-09-20 19:06 – Updated: 2024-08-03 01:14
VLAI
EPSS
VEX
Title
Instack-undercloud: rsync leaks information to undercloud
Summary
An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2022:8897 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2022-3596 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2136596 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat OpenStack Platform 13.0 - ELS |
Unaffected:
0:8.4.9-13.el7ost , < *
(rpm)
cpe:/a:redhat:openstack:13::el7 |
|
| Red Hat | Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS |
Unaffected:
0:8.4.9-13.el7ost , < *
(rpm)
cpe:/a:redhat:openstack:13::el7 |
Date Public
2022-12-05 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T19:52:27.052407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:15:32.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:14:02.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2022:8897",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2022:8897"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2022-3596"
},
{
"name": "RHBZ#2136596",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136596"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:13::el7"
],
"defaultStatus": "affected",
"packageName": "instack-undercloud",
"product": "Red Hat OpenStack Platform 13.0 - ELS",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.4.9-13.el7ost",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:13::el7"
],
"defaultStatus": "affected",
"packageName": "instack-undercloud",
"product": "Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.4.9-13.el7ost",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Maciej Relewicz (Juniper Networks) for reporting this issue."
}
],
"datePublic": "2022-12-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An information leak was found in OpenStack\u0027s undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-402",
"description": "Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T15:32:25.112Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2022:8897",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2022:8897"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2022-3596"
},
{
"name": "RHBZ#2136596",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136596"
}
],
"timeline": [
{
"lang": "en",
"time": "2022-10-04T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2022-12-05T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Instack-undercloud: rsync leaks information to undercloud",
"workarounds": [
{
"lang": "en",
"value": "The rsync daemon is no longer needed and can be manually disabled by running the following commands on the undercloud:\n\n sudo rm /etc/xinetd.d/rsync /etc/rsyncd.conf \n sudo systemctl restart xinetd\n\nHowever, this will be reverted if the undercloud gets updated."
}
],
"x_redhatCweChain": "CWE-402: Transmission of Private Resources into a New Sphere (\u0027Resource Leak\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2022-3596",
"datePublished": "2023-09-20T19:06:28.487Z",
"dateReserved": "2022-10-18T23:34:01.540Z",
"dateUpdated": "2024-08-03T01:14:02.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}