CVE-2015-5271: Infoleak
First published: Thu Sep 10 2015(Updated: )
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Openstack | =7.0 | |
| Openstack Tripleo Heat Templates | ||
| pip/tripleo-heat-templates | <0.8.7 | 0.8.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2015:1862
- https://bugs.launchpad.net/tripleo/+bug/1494896
- https://bugzilla.redhat.com/show_bug.cgi?id=1261697
- https://launchpadlibrarian.net/217268516/CVE-2015-5271_puppet-swift.patch
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1261499
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1272860
- https://nvd.nist.gov/vuln/detail/CVE-2015-5271
- https://access.redhat.com/security/cve/CVE-2015-5271
- https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=1730d95acdbee7c7bbcfe1eba8a48ef2b0cc1476
- https://review.openstack.org/226541
- https://github.com/pypa/advisory-database/tree/main/vulns/tripleo-heat-templates/PYSEC-2016-34.yaml
- https://github.com/advisories/GHSA-8936-44gw-7664 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2015-5271?
CVE-2015-5271 has a medium severity level due to potential information exposure to remote attackers.
How do I fix CVE-2015-5271?
To fix CVE-2015-5271, upgrade the tripleo-heat-templates package to version 0.8.7 or higher.
What software is affected by CVE-2015-5271?
CVE-2015-5271 affects Red Hat OpenStack 7.0 and OpenStack Tripleo Heat Templates.
What is the impact of CVE-2015-5271?
The impact of CVE-2015-5271 may allow remote attackers to obtain sensitive information due to improper middleware ordering.
Is there a known workaround for CVE-2015-5271?
There is no specific workaround documented for CVE-2015-5271; the recommended action is to apply the available patch.
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5271
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8936-44gw-7664
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- vendor/redhat
- canonical/redhat openstack
- version/redhat openstack/7.0
- vendor/openstack
- canonical/openstack tripleo heat templates
- package-manager/pip