CVE-2016-9590 puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet sc...
MediumCVSS 6.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/puppet-module-swift(Debian:12) | < 9.4.4-1 | 9.4.4-1 |
| debian/puppet-module-swift(Debian:13) | < 9.4.4-1 | 9.4.4-1 |
| OpenStack puppet-swift | >= 8.0.0, < 8.2.1 | 8.2.1 |
| OpenStack puppet-swift | >= 9.0.0, < 9.4.4 | 9.4.4 |
| redhat openstack | = 8 | No fix listed |
| redhat openstack | = 9 | No fix listed |
| redhat openstack | = 10 | No fix listed |
References
- Debian Security Tracker CVE-2016-9590 vendor-advisory
- RHSA-2017:0200 vendor-advisory
- RHSA-2017:0359 vendor-advisory
- RHSA-2017:0361 vendor-advisory
- 95448 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch vendor-advisory
- bugs.debian.org issue-tracking