CVE-2017-12155
Openstack tripleo-heat-templates unauthenticated file access
描述
A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions [7.0.6](https://github.com/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4) and [8.0.0](https://github.com/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30).
如何修補 CVE-2017-12155
要修補 CVE-2017-12155,請將受影響套件升級到下列已修補版本。
- —升級至 7.0.6 或更新版本
- —升級至 7.0.6 或更新版本
CVE-2017-12155 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 7.0.6
- from 0, < 7.0.6
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.3 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |