Description
A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.0 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-openstackclient | 6.3.0-2 | — |
| Debian 13 | python-openstackclient | 6.3.0-2 | — |
| Debian 12 | python-openstackclient | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python-openstackclient | 5.8.0-0ubuntu1.1 | USN-6668-1 |
| Ubuntu 20.04 LTS | python-openstackclient | 5.2.0-0ubuntu1.20.04.2 | USN-6668-1 |
| Ubuntu 18.04 LTS | python-openstackclient | No fix yet | — |
| Ubuntu 16.04 LTS | python-openstackclient | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | python-openstackclient +2 | 5.5.2-17.1.20230829210830.el9ost | RHSA-2024:2769, RHSA-2024:2737 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | python-openstackclient | < 6.3.0 | 6.3.0 | GHSA-2ppf-2m6f-6v6f |
Advisories 4
- RHSA-2024:2769 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-openstackclient) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2024:2737 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-openstackclient) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-6668-1 python-openstackclient vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2024-1228 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2026
References
- RHSA-2024:2737 vendor-advisory
- RHSA-2024:2769 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-6110 vdb-entry
- RHBZ#2212960 issue-tracking
- https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf
- https://review.opendev.org/c/openstack/python-openstackclient/+/888697