Summary
It was discovered that when python-openstackclient attempted to delete a
non-existing access rule, it would delete another existing access rule
instead, contrary to expectations.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python-openstackclient | 5.2.0-0ubuntu1.20.04.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | python-openstackclient | 5.8.0-0ubuntu1.1 |
Vulnerabilities 1
-
Medium 5.5
Openstack: deleting a non existing access rule deletes another existing access rule in it's scope
A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.
References
-
report
https://ubuntu.com/security/CVE-2023-6110