CVE-2017-12155: Medium severity ceph Ceph Openstack vulnerability
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
Other sources
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
— MITRE
When deploying overcloud by Director, it was found that ceph client keyring is created as world-readable potentially allowing local attackers to read or modify data of guests.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1462657
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12155?
CVE-2017-12155 is classified as a medium severity vulnerability due to its potential impact on data integrity and security in Ceph clusters.
How do I fix CVE-2017-12155?
To fix CVE-2017-12155, update the `tripleo-heat-templates` package to version 7.0.6 or later.
What type of vulnerability is CVE-2017-12155?
CVE-2017-12155 is a resource-permission flaw that allows unauthorized access to sensitive data.
Who is affected by CVE-2017-12155?
CVE-2017-12155 affects any user or organization using the `tripleo-heat-templates` package with Ceph in an OpenStack environment.
What are the consequences of CVE-2017-12155?
The consequences of CVE-2017-12155 include a local attacker being able to read or modify data on Ceph cluster pools as if they were an authorized OpenStack service.