ALT-PU-2020-4282

Высокий

ALT-PU-2020-4282: package openstack-cinder update to version 15.4.0-alt1

Источник

errata.altlinux.org

Дата публикации

02.12.2020

Дата обновления

02.12.2020

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades openstack-cinder to version 15.4.0-alt1.

Устраненные уязвимости1

CVE-2020-10755

Средний 6.5

Дата публикации: 10.06.2020

CWE-522

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the connection_info element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project * GHSA-v3m2-pg96-w33m: Openstack cinder Improper handling of ScaleIO backend credentials

CVSS 3.1

Средний 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS 2.0

Средний 4.3

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access vector: Network
Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

CVE-2020-10755 https://nvd.nist.gov/vuln/detail/CVE-2020-10755

Ссылки2

ALT-PU-2020-4282 https://errata.altlinux.org/ALT-PU-2020-4282

GHSA-v3m2-pg96-w33m

https://github.com/advisories/GHSA-v3m2-pg96-w33m

Связанные уязвимости

CVE-2020-10755

CVSS3: 6.5

ubuntu

больше 6 лет назад

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

CVE-2020-10755

CVSS3: 6.5

redhat

больше 6 лет назад

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

CVE-2020-10755

CVSS3: 6.5

nvd

больше 6 лет назад

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

CVE-2020-10755

CVSS3: 6.5

debian

больше 6 лет назад

An insecure-credentials flaw was found in all openstack-cinder version ...

GHSA-v3m2-pg96-w33m

CVSS3: 6.5

github

больше 4 лет назад

Openstack cinder Improper handling of ScaleIO backend credentials