Description
The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-installer 6 | foreman-discovery-image | 7.0-20150227.0.el7ost | RHSA-2015:0791 |
| Red Hat Openstack-installer 6 | foreman-proxy | 1.6.0.30-6.el7ost | RHSA-2015:0791 |
| Red Hat Openstack-installer 6 | openstack-foreman-installer | 3.0.22-1.el7ost | RHSA-2015:0791 |
| Red Hat Openstack-installer 6 | openstack-puppet-modules | 2014.2.13-2.el7ost | RHSA-2015:0791 |
| Red Hat Openstack-installer 6 | rhel-osp-installer +1 | 1:0.5.7-1.el7ost | RHSA-2015:0791 |
| Red Hat Openstack-installer 6 | ruby193-rubygem-staypuft +1 | 0.5.22-1.el7ost | RHSA-2015:0791 |
| Red Hat Openstack-installer 5 | augeas | 1.0.0-7.el6_6.1 | RHSA-2015:0830 |
| Red Hat Openstack-installer 5 | openstack-foreman-installer | 2.0.34-1.el6ost | RHSA-2015:0830 |
| Red Hat Openstack-installer 5 | openstack-puppet-modules | 2014.1.2-1.el6ost | RHSA-2015:0830 |
| Red Hat Openstack-installer 5 | rhel-osp-installer | 1:0.4.7-2.el6ost | RHSA-2015:0830 |
| Red Hat Openstack-installer 5 | ruby193-rubygem-staypuft +1 | 0.4.15-1.el6ost | RHSA-2015:0830 |
| Red Hat OpenStack 6 | openstack-packstack +2 | 2014.2-0.20.dev1467.g70c9655.el7ost | RHSA-2015:0789 |
| Red Hat OpenStack 6 | openstack-puppet-modules | 2014.2.13-2.el7ost | RHSA-2015:0789 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | openstack-packstack +2 | 2014.1.1-0.46.dev1280.el6ost | RHSA-2015:0832, RHSA-2015:0831 |
| Red Hat OpenStack 5 | openstack-puppet-modules | 2014.1.2-1.el6ost | RHSA-2015:0832, RHSA-2015:0831 |
Advisories 5
- RHSA-2015:0832 Red Hat Security Advisory: openstack-packstack and openstack-puppet-modules update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2015:0831 Red Hat Security Advisory: openstack-packstack and openstack-puppet-modules update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2015:0789 Red Hat Security Advisory: openstack-packstack and openstack-puppet-modules security and bug fix update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2015:0791 Red Hat Security Advisory: Red Hat Enterprise Linux OpenStack Platform Installer update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2015:0830 Red Hat Security Advisory: openstack-foreman-installer security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
References
- RHSA-2015:0791 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1201875
- 74049 vdb-entry
- RHSA-2015:0831 vendor-advisory
- RHSA-2015:0832 vendor-advisory
- RHSA-2015:0789 vendor-advisory
- RHSA-2015:0830 vendor-advisory