Description
The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | tripleo-heat-templates | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-director 7 | openstack-tripleo-heat-templates | 0.8.6-94.el7ost | RHSA-2015:2650 |
| Red Hat Openstack-director 7 | python-rdomanager-oscplugin | 0.0.10-22.el7ost | RHSA-2015:2650 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tripleo-heat-templates | < 0.8.10 | 0.8.10 | GHSA-m94p-8942-pm49 |
| PyPI | tripleo-heat-templates | < 0.8.9 | 0.8.9 | PYSEC-2016-35 |
Advisories 1
- RHSA-2015:2650 Red Hat Security Advisory: Red Hat Enterprise Linux OpenStack Platform 7 director update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- RHSA-2015:2650 vendor-advisory
- https://bugs.launchpad.net/tripleo/+bug/1516027