Tripleo Ansible CVEs and Security Vulnerabilities

CVE-2022-3101

tripleo-ansible: /var/lib/mistral/overcloud discoverable

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Tripleo Ansible Openstack Openstack For Ibm Power

CVE-2022-3146

tripleo-ansible: /etc/openstack/clouds.yaml discoverable

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.