CVE-2015-3156: Medium severity openstack trove vulnerability
Michael Scherer of Red Hat reported multiple issues in OpenStack Trove where temporary files are used in an insecure way in different modules:
trove: MongoDB datastore module in guestagent insecure /tmp file usage in writeconfig() https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/mongodb/service.py#L176
trove: PostgreSQL datastore module in guestagent insecure /tmp file usage in resetconfiguration() https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/postgresql/service/config.py#L70
trove: Redis datastore module in guestagent insecure /tmp file usage in writeconfig() https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/redis/service.py#L236
trove: MySQL datastore module in guestagent insecure /tmp file usage in writemycnf() https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/mysql/service.py#L790
trove: MySQL restore strategy in guestagent insecure /tmp file usage in InnoBackupEx::runprepare() https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/restore/mysqlimpl.py#L194
trove: MySQL backup strategy in guestagent insecure /tmp file usage in InnoBackupEx::cmd() https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysqlimpl.py#L55
trove: MySQL backup strategy in guestagent insecure /tmp file usage in MySQLDump::cmd() https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysqlimpl.py#L36
trove: MySQL backup strategy in guestagent insecure /tmp file usage in InnoBackupExIncremental::cmd() https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysqlimpl.py#L110
trove: Cassandra datastore module insecure /tmp file usage in getactualdbstatus() https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/system.py#L33 https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/service.py#L230
trove: Couchbase backup strategy insecure /tmp file usage in multiple class CbBackup methods https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/experimental/couchbaseimpl.py#L30
Other sources
The writeconfig function in trove/guestagent/datastore/experimental/mongodb/service.py, resetconfiguration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, writeconfig function in trove/guestagent/datastore/experimental/redis/service.py, writemycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::runprepare function in trove/guestagent/strategies/restore/mysqlimpl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysqlimpl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysqlimpl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysqlimpl.py, getactualdbstatus function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbaseimpl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
The writeconfig function in trove/guestagent/datastore/experimental/mongodb/service.py, resetconfiguration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, writeconfig function in trove/guestagent/datastore/experimental/redis/service.py, writemycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::runprepare function in trove/guestagent/strategies/restore/mysqlimpl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysqlimpl.py,MySQLDump::cmd in trove/guestagent/strategies/backup/mysqlimpl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysqlimpl.py, getactualdbstatus function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbaseimpl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3156?
CVE-2015-3156 has been classified as a medium severity vulnerability.
What software is affected by CVE-2015-3156?
CVE-2015-3156 affects OpenStack Trove versions up to and including 2014.2.4.
How do I fix CVE-2015-3156?
To fix CVE-2015-3156, you should upgrade OpenStack Trove to version 4.0.0a0 or later.
What type of vulnerability is CVE-2015-3156?
CVE-2015-3156 is a vulnerability related to insecure temporary file usage.
Who reported CVE-2015-3156?
CVE-2015-3156 was reported by Michael Scherer from Red Hat.