GHSA-j8cr-2gxr-hvvjLowCVSS 5.5
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable...
🔗 CVE IDs covered (1)
📋 Description
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2013-0266
- https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc
- https://bugzilla.redhat.com/show_bug.cgi?id=908581
- http://rhn.redhat.com/errata/RHSA-2013-0595.html
- https://access.redhat.com/security/cve/CVE-2013-0266
- https://access.redhat.com/errata/RHSA-2013:0595
- https://github.com/advisories/GHSA-j8cr-2gxr-hvvj