Skip to content

CVE-2017-7549 instack-undercloud vulnerable to symlink attack on tmp files

MediumCVSS 6.4 EPSS 0.35%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Affected products

ProductAffected versionsFixed in
pypi instack-undercloud(PyPI) <= 7.2.0 No fix listed
pypi instack-undercloud(PyPI) = 4.0.1.dev90 No fix listed
pypi instack-undercloud(PyPI) = 4.1.0 No fix listed
pypi instack-undercloud(PyPI) = 4.2.0 No fix listed
pypi instack-undercloud(PyPI) = 4.2.1 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0.0b1 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0.0b2 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0.0b3 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0.0rc1 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0.0rc2 No fix listed
pypi instack-undercloud(PyPI) = 5.0.0.0rc3 No fix listed
pypi instack-undercloud(PyPI) = 5.1.0 No fix listed
pypi instack-undercloud(PyPI) = 5.2.0 No fix listed
pypi instack-undercloud(PyPI) = 5.3.0 No fix listed
pypi instack-undercloud(PyPI) = 5.3.1 No fix listed
pypi instack-undercloud(PyPI) = 5.3.10 No fix listed
pypi instack-undercloud(PyPI) = 5.3.2 No fix listed
pypi instack-undercloud(PyPI) = 5.3.3 No fix listed
pypi instack-undercloud(PyPI) = 5.3.4 No fix listed
pypi instack-undercloud(PyPI) = 5.3.5 No fix listed
pypi instack-undercloud(PyPI) = 5.3.6 No fix listed
pypi instack-undercloud(PyPI) = 5.3.7 No fix listed
pypi instack-undercloud(PyPI) = 5.3.8 No fix listed
pypi instack-undercloud(PyPI) = 5.3.9 No fix listed
Show 30 more
ProductAffected versionsFixed in
pypi instack-undercloud(PyPI) = 6.0.0 No fix listed
pypi instack-undercloud(PyPI) = 6.0.0.0b2 No fix listed
pypi instack-undercloud(PyPI) = 6.0.0.0rc1 No fix listed
pypi instack-undercloud(PyPI) = 6.0.0.0rc2 No fix listed
pypi instack-undercloud(PyPI) = 6.1.0 No fix listed
pypi instack-undercloud(PyPI) = 6.1.1 No fix listed
pypi instack-undercloud(PyPI) = 6.1.2 No fix listed
pypi instack-undercloud(PyPI) = 6.1.3 No fix listed
pypi instack-undercloud(PyPI) = 6.1.4 No fix listed
pypi instack-undercloud(PyPI) = 6.1.5 No fix listed
pypi instack-undercloud(PyPI) = 6.1.6 No fix listed
pypi instack-undercloud(PyPI) = 6.1.7 No fix listed
pypi instack-undercloud(PyPI) = 6.1.8 No fix listed
pypi instack-undercloud(PyPI) = 7.0.0 No fix listed
pypi instack-undercloud(PyPI) = 7.0.0.0b1 No fix listed
pypi instack-undercloud(PyPI) = 7.1.0 No fix listed
pypi instack-undercloud(PyPI) = 7.2.0 No fix listed
pypi instack(PyPI) <= 7.2.0 No fix listed
pypi instack(PyPI) <= 6.1.0 No fix listed
pypi instack(PyPI) <= 5.3.0 No fix listed
pypi instack(PyPI) = 0.0.9.dev4 No fix listed
pypi instack(PyPI) = 5.0.0 No fix listed
pypi instack(PyPI) = 5.0.0.0b1 No fix listed
pypi instack(PyPI) = 5.0.0.0b2 No fix listed
pypi instack(PyPI) = 5.1.0 No fix listed
pypi instack(PyPI) = 6.1.0 No fix listed
OpenStack instack-undercloud = 7.2.0 No fix listed
OpenStack instack-undercloud = 6.1.0 No fix listed
OpenStack instack-undercloud = 5.3.0 No fix listed
redhat instack-undercloud = Pike, 12: v7.2.0, Ocata, 11: v6.1.0, Newton, 10: v5.3.0 No fix listed

References