CVE-2020-1690
First published: Fri Jan 10 2020(Updated: )
An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service. Versions before openstack-selinux 0.8.24 are affected.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openstack-selinux | <0.8.24 | 0.8.24 |
| Redhat Openstack-selinux | <0.8.24 | |
| Redhat Openstack Platform | =15.0 | |
| Redhat Openstack Platform | =16.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1789640
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1789640#c0
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1738134
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1788561
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1803657
- https://access.redhat.com/errata/RHSA-2020:4381
- https://access.redhat.com/security/cve/cve-2020-1690
Frequently Asked Questions
What is the vulnerability ID of this security flaw?
The vulnerability ID of this security flaw is CVE-2020-1690.
What is the severity level of CVE-2020-1690?
CVE-2020-1690 has a severity level of medium.
What is the affected software by CVE-2020-1690?
The affected software by CVE-2020-1690 includes openstack-selinux version 0.8.24, Redhat Openstack-selinux version up to exclusive 0.8.24, Redhat Openstack Platform version 15.0, and Redhat Openstack Platform version 16.1.
How can the vulnerability be fixed?
To fix CVE-2020-1690, it is recommended to apply the remedy version 0.8.24 for openstack-selinux or upgrade to a higher version of Redhat Openstack Platform.
Is there any reference for more information about CVE-2020-1690?
Yes, you can find more information about CVE-2020-1690 at the following references: [Bugzilla Bug 1789640](https://bugzilla.redhat.com/show_bug.cgi?id=1789640) and [Bugzilla Bug 1738134](https://bugzilla.redhat.com/show_bug.cgi?id=1738134).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-1690
- agent/software-canonical-lookup
- vendor/redhat
- canonical/redhat openstack-selinux
- canonical/redhat openstack platform
- version/redhat openstack platform/15.0
- version/redhat openstack platform/16.1
- package-manager/redhat