CVE-2017-12155 in openstack-tripleo-heat-templates
Summary
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Reservation
08/01/2017
Disclosure
12/12/2017
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 110554 | openstack-tripleo-heat-templates Permission access control | 264 | Not defined | Not defined | CVE-2017-12155 |