CVE-2018-17954: crowbar provision leaks admin password to all nodes in cleartext
First published: Fri Apr 03 2020(Updated: )
An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.
Credit: meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SUSE OpenStack Cloud | =7.0 | |
| SUSE OpenStack Cloud | =8.0 | |
| SUSE OpenStack Cloud | =9.0 | |
| SUSE OpenStack Cloud Crowbar | =8.0 | |
| SUSE OpenStack Cloud Crowbar | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID is CVE-2018-17954.
What is the severity level of CVE-2018-17954?
CVE-2018-17954 has a severity level of critical.
Which versions of SUSE OpenStack Cloud are affected by this vulnerability?
This vulnerability affects SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, and SUSE OpenStack Cloud 9.
How does CVE-2018-17954 impact the system?
CVE-2018-17954 allows root users on any crowbar managed node to become root on any other node.
Is there a fix available for CVE-2018-17954?
Yes, a fix is available. Please refer to the reference link for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/suse
- canonical/suse openstack cloud
- version/suse openstack cloud/7.0
- version/suse openstack cloud/8.0
- version/suse openstack cloud/9.0
- canonical/suse openstack cloud crowbar
- version/suse openstack cloud crowbar/8.0
- version/suse openstack cloud crowbar/9.0