CVE-2017-2622: Infoleak
An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.
Other sources
The directory /var/log/mistral is world readable and contains log files that are readable, which can result in the exposure of sensitive information. The 'other readable/execute' bits need to be removed from the /var/log/mistral directory:
[stack@instack ~]$ ls -la /var/log/mistral total 2288 drwxr-xr-x. 2 mistral mistral 4096 Feb 9 01:07 . drwxr-xr-x. 31 root root 4096 Feb 9 01:02 .. -rw-r--r--. 1 mistral mistral 112623 Feb 9 20:09 api.log -rw-r--r--. 1 mistral mistral 1829883 Feb 9 20:09 engine.log -rw-r--r--. 1 mistral mistral 383889 Feb 9 20:09 executor.log
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2622?
CVE-2017-2622 has a medium severity level due to the exposure of potentially sensitive log information.
How do I fix CVE-2017-2622?
To fix CVE-2017-2622, restrict the permissions of the /var/log/mistral directory to prevent world-readable access.
Who is affected by CVE-2017-2622?
CVE-2017-2622 primarily affects users running Red Hat OpenStack version 10.
What kind of information could be exposed due to CVE-2017-2622?
CVE-2017-2622 could expose sensitive user and operational log information that may aid an attacker.
Is CVE-2017-2622 exploitable by non-privileged users?
Yes, CVE-2017-2622 can be exploited by any malicious system user due to the world-readable permissions on the log directory.