CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.

Score

CVSS 3.0 6.5 Medium

Status

Modified - secalert@redhat.com

Published

2018-04-26

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Puppet-swift (Openstack)
• Openstack (Redhat)
• Puppet-swift (Unspecified)

References

• http://rhn.redhat.com/errata/RHSA-2017-0200.html
• http://rhn.redhat.com/errata/RHSA-2017-0359.html
• http://rhn.redhat.com/errata/RHSA-2017-0361.html
• http://www.securityfocus.com/bid/95448
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9590