CVE-2015-6861: High severity eucalyptus vulnerability
Published Jan 5, 2016
·Updated
HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by leveraging a policy setting for a user's account.
Affected Software
11 affected components
Eucalyptus Eucalyptus=3.4.0
Eucalyptus Eucalyptus=3.4.1
Eucalyptus Eucalyptus=3.4.2
Eucalyptus Eucalyptus=3.4.3
Eucalyptus Eucalyptus=4.0.0
Eucalyptus Eucalyptus=4.0.1
Eucalyptus Eucalyptus=4.0.2
Eucalyptus Eucalyptus=4.1.0
Eucalyptus Eucalyptus=4.1.1
Eucalyptus Eucalyptus=4.1.2
Eucalyptus Eucalyptus=4.2.0
Event History
Jan 5, 2016
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6861?
CVE-2015-6861 has been classified with a medium severity due to its potential impact on IAM role permissions.
2
How do I fix CVE-2015-6861?
To fix CVE-2015-6861, you should upgrade to a version of HPE Helion Eucalyptus that is higher than 4.2.0.
3
Who is affected by CVE-2015-6861?
CVE-2015-6861 affects users of HPE Helion Eucalyptus versions 3.4.0 through 4.2.0.
4
What is the nature of the vulnerability in CVE-2015-6861?
CVE-2015-6861 allows remote authenticated users to bypass security measures for assuming IAM roles.
5
When was CVE-2015-6861 disclosed?
CVE-2015-6861 was publicly disclosed in October 2015.