CVE-2023-6725
Fixed in a distro release EPSS <1%CVSS 5.5
An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.
Products: Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openstack 17.1 | openstack-tripleo-heat-templates | 0:14.3.1-17.1.20231103010840.el9ost |
| Red Hat openstack 17.1 | openstack-tripleo-heat-templates | 0:14.3.1-17.1.20231103003762.el8ost |
| Red Hat openstack 17.1 | tripleo-ansible | 0:3.3.1-17.1.20231101230831.el9ost |
| Red Hat openstack 17.1 | tripleo-ansible | 0:3.3.1-17.1.20231101233754.el8ost |