Description
An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | openstack-heat | openstack-heat-8.0.0, openstack-heat-6.1.0, openstack-heat-7.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 10 | openstack-heat +6 | 1:7.0.2-4.el7ost | RHSA-2017:1243 |
| Red Hat OpenStack 9 | openstack-heat +6 | 1:6.1.0-3.el7ost | RHSA-2017:1464 |
Advisories 2
- RHSA-2017:1464 Red Hat Security Advisory: openstack-heat security and bug fix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2017:1243 Red Hat Security Advisory: openstack-heat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2621
- RHSA-2017:1243 vendor-advisory
- RHSA-2017:1464 vendor-advisory
- 96280 vdb-entry