CVE-2021-4180: Infoleak
According to parameter description, [keystoneauthtoken] wwwauthenticateuri should be public URL. However TripleO currently uses internal endpoint for this parameter.
References: https://bugs.launchpad.net/tripleo/+bug/1955397 https://bugzilla.redhat.com/showbug.cgi?id=2034203
Other sources
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openstack-tripleo-heat-templatesto a version that resolves this vulnerability.Fixed in 11.6.1 - Upgrade
Upgrade
openstack-tripleo-heat-templatesto a version that resolves this vulnerability.Fixed in 11.6.1 - Configuration
Set keystone_authtoken.www_authenticate_uri to a public URL as described by the parameter; avoid using an internal endpoint for this value.
TripleO keystone_authtoken www_authenticate_uri = public URL - Compensating control
Limit information exposure by ensuring internal IP/hostname values are not disclosed via publicly visible configuration parameters.
Event History
Frequently Asked Questions
What is CVE-2021-4180?
CVE-2021-4180 is an information exposure flaw in openstack-tripleo-heat-templates that allows an external user to discover the internal IP or hostname.
How can an attacker exploit CVE-2021-4180?
An attacker can exploit CVE-2021-4180 by checking the www_authenticate_uri parameter in configuration files.
What is the severity of CVE-2021-4180?
The severity of CVE-2021-4180 is medium with a CVSS score of 4.3.
Which software is affected by CVE-2021-4180?
Openstack Tripleo Heat Templates 11.6.1, Redhat Openstack 13, Redhat Openstack 16.1, Redhat Openstack 16.2, and Redhat Openstack tripleo-heat-templates package version 11.6.1 are affected by CVE-2021-4180.
How do I fix CVE-2021-4180?
To fix CVE-2021-4180, update to a version of openstack-tripleo-heat-templates that is higher than 11.6.1.