Red Hat Security Advisory: openstack-packstack security and bug fix update

Fixed packages 1

Vulnerabilities 2

• High 8.8
  CVE-2013-0261

  Packstack: packstack: arbitrary file overwrite via symlink attack

  A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system …

  Red Hat OpenStack Folsom for RHEL 6 Red Hat OpenStack Platform 4 Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Linux
  Mar 8, 2013
• Medium 5.5
  CVE-2013-0266

  Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.

  A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit …

  Red Hat OpenStack Folsom for RHEL 6 Red Hat OpenStack Platform 4 Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) Linux
  Mar 8, 2013

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=886592
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=890295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=892942
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=903187
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=904669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=905516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=905737
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=906006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=906410
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=907624
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=907737
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=908101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=908581
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=910211
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=910818
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=911653
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0595.json
• report
  https://access.redhat.com/security/cve/CVE-2013-0261
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0261
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0261
• report
  https://access.redhat.com/security/cve/CVE-2013-0266
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0266