CVE-2015-1842: Critical severity redhat Openstack vulnerability
It was discovered that openstack-puppet-modules as used by the Red Hat Enterprise Linux OpenStack Platform Installers would always use the default password of "CHANGEME" when deploying pcsd in HA environments.
Other sources
The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1842?
The severity of CVE-2015-1842 is considered high due to the use of a default password, allowing unauthorized access.
How do I fix CVE-2015-1842?
To fix CVE-2015-1842, change the default password from "CHANGEME" to a secure password during the deployment of pcsd.
Which versions are affected by CVE-2015-1842?
CVE-2015-1842 affects Red Hat OpenStack versions prior to 2014.2.13-2.
What environments are impacted by CVE-2015-1842?
CVE-2015-1842 impacts high availability (HA) environments using openstack-puppet-modules.
Is there a workaround for CVE-2015-1842?
A temporary workaround for CVE-2015-1842 is to manually configure the pcsd password immediately after deployment.