Vulnerability · Published Mar 15, 2024 · Assigned by redhat
CVE-2023-6725Tripleo-ansible: bind keys are world readable
Medium 5.5
In plain English
A medium-severity security flaw in Red Hat OpenStack Platform 16.1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | see references |
| Red Hat | Red Hat OpenStack Platform 16.1 | see references |
| Red Hat | Red Hat OpenStack Platform 16.2 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 | see references |
| Red Hat | Red Hat OpenStack Platform 18.0 | see references |
Weakness: CWE-1220 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2024:2736 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2770 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6725 vdb-entry, x_refsource_REDHAT
- RHBZ#2249273 issue-tracking, x_refsource_REDHAT