Description
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | tripleo-ansible | unknown | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 16 | python3-tripleo-common | 11.4.1-1.20211201113404.el8ost | RHSA-2022:6969 |
| Red Hat OpenStack 16 | tripleo-ansible | 0.5.1-1.20220114163454.el8ost | RHSA-2022:6969 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tripleo-ansible | <= 6.0.0 | — | GHSA-7x96-2w32-w3gw |
Advisories 1
- RHSA-2022:6969 Red Hat Security Advisory: Red Hat OpenStack Platform (tripleo-ansible) security update Red Hat Security Advisories (RHSA) · Aug 8, 2026