CVE-2018-10898
Fixed in a distro release EPSS <1%CVSS 8.8
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.
Products: redhat openstack, openstack tripleo_heat_templates
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | tripleo-heat-templates | 8.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openstack 13 | openstack-tripleo-common | 0:8.6.1-23.el7ost |
| Red Hat openstack 13 | openstack-tripleo-common-container-base | 0:8.6.1-23.el7ost |
| Red Hat openstack 13 | openstack-tripleo-common-containers | 0:8.6.1-23.el7ost |
| Red Hat openstack 13 | openstack-tripleo-common-devtools | 0:8.6.1-23.el7ost |
| Red Hat openstack 13 | openstack-tripleo-heat-templates | 0:8.0.2-43.el7ost |
| Red Hat openstack 13 | puppet-opendaylight | 0:8.1.2-2.38977efgit.el7ost |
| Red Hat openstack 13 | python-tripleoclient | 0:9.2.1-13.el7ost |
| Ubuntu 16.04 LTS | tripleo-heat-templates | no fix |
| Ubuntu 18.04 LTS | tripleo-heat-templates | no fix |