Description
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | tripleo-ansible | unkown | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 16 | python3-tripleo-common | 11.4.1-1.20211201113404.el8ost | RHSA-2022:6969 |
| Red Hat OpenStack 16 | tripleo-ansible | 0.5.1-1.20220114163454.el8ost | RHSA-2022:6969 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tripleo-ansible | <= 6.0.0 | — | GHSA-w4x6-6w3r-9h2m |
Advisories 1
- RHSA-2022:6969 Red Hat Security Advisory: Red Hat OpenStack Platform (tripleo-ansible) security update Red Hat Security Advisories (RHSA) · Aug 8, 2026