Description
An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenStack Platform 13.0 - ELS | — | — |
| Red Hat | Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 13 | instack-undercloud | 8.4.9-13.el7ost | RHSA-2022:8897 |
Advisories 2
- RHSA-2022:8897 Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (instack-undercloud) security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2022-2272 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 8, 2022
References
- RHSA-2022:8897 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2022-3596 vdb-entry
- RHBZ#2136596 issue-tracking