CVE-2017-7549: Medium severity Openstack instack-undercloud vulnerability
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
Other sources
Description of problem: /usr/share/instack-undercloud/ipxe/post-install.d/86-selinux uses: /tmp/ipxe.mod to compile the selinux policy isolated-build/pre-install.d/00-disable-external-installs uses /tmp/yum-blacklist (all versions)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7549?
CVE-2017-7549 is considered a moderate severity vulnerability due to the potential for local users to exploit insecure temporary file usage.
How do I fix CVE-2017-7549?
To fix CVE-2017-7549, update instack-undercloud to a version that has addressed this vulnerability.
Which versions of instack-undercloud are affected by CVE-2017-7549?
CVE-2017-7549 affects instack-undercloud versions 5.3.0, 6.1.0, and 7.2.0.
Can a remote user exploit CVE-2017-7549?
No, CVE-2017-7549 can only be exploited by local users due to the nature of the vulnerability.
Is CVE-2017-7549 specific to Red Hat OpenStack?
Yes, CVE-2017-7549 specifically impacts OpenStack deployments utilizing instack-undercloud packaged in various Red Hat OpenStack Platform versions.