CVE-2023-6725: Tripleo-ansible: bind keys are world readable
An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.
Other sources
Description of problem:
The /etc/designate directory, /etc/designate/private, and /etc/designate/private/bind1.conf files are all world readable. This exposes the RNDC keys to anyone able access the container.
Inside the container: $ ls -al /etc/designate/ total 88 drwxr-xr-x. 1 root root 80 Sep 11 17:41 . drwxr-xr-x. 1 root root 55 Sep 11 17:41 .. -rw-r-----. 1 root designate 70205 Sep 11 16:31 designate.conf -rw-r-----. 1 root designate 6060 Sep 11 16:31 policy.yaml -rw-r--r--. 1 root root 2125 Sep 11 16:44 pools.yaml drwxr-xr-x. 2 root root 60 Sep 11 17:41 private -rw-r-----. 1 root designate 949 Jul 8 2022 rootwrap.conf
$ ls -al /etc/designate/private/ total 12 drwxr-xr-x. 2 root root 60 Sep 11 17:41 . drwxr-xr-x. 1 root root 80 Sep 11 17:41 .. -rw-r--r--. 1 root root 196 Sep 11 16:27 bind1.conf -rw-r--r--. 1 root root 196 Sep 11 16:27 bind2.conf -rw-r--r--. 1 root root 196 Sep 11 16:27 bind3.conf
On the overcloud host: $ ls -al /var/lib/config-data/puppet-generated/designate/etc/designate/private/bind1.conf -rw-r--r--. 1 root root 196 Sep 11 16:27 /var/lib/config-data/puppet-generated/designate/etc/designate/private/bind1.conf
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6725?
The severity of CVE-2023-6725 is classified as critical due to its potential to expose sensitive private configuration information.
How do I fix CVE-2023-6725?
To fix CVE-2023-6725, update the OpenStack Designate component to the latest patched version that resolves the access control flaw.
What software is affected by CVE-2023-6725?
CVE-2023-6725 affects the OpenStack Designate component specifically.
What kind of information is exposed by CVE-2023-6725?
CVE-2023-6725 exposes private configuration information, including access keys to BIND, making it vulnerable to unauthorized access.
Who can exploit CVE-2023-6725?
Any malicious attacker with access to an affected container can exploit CVE-2023-6725 to gain access to sensitive information.