Vulnerability · Published Jun 7, 2021 · Assigned by redhat

CVE-2020-1690

Medium 6.5

In plain English

A medium-severity security flaw in openstack-selinux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service. Versions before openstack-selinux 0.8.24 are affected.

Affected products (as reported)

Vendor	Product	Versions
n/a	openstack-selinux	before openstack-selinux 0.8.24

Weakness: CWE-285

References

https://bugzilla.redhat.com/show_bug.cgi?id=1789640 x_refsource_MISC