REDHAT-BUG-2249273: Medium severity Openstack Designate vulnerability
Description of problem:
The /etc/designate directory, /etc/designate/private, and /etc/designate/private/bind1.conf files are all world readable. This exposes the RNDC keys to anyone able access the container.
Inside the container: $ ls -al /etc/designate/ total 88 drwxr-xr-x. 1 root root 80 Sep 11 17:41 . drwxr-xr-x. 1 root root 55 Sep 11 17:41 .. -rw-r-----. 1 root designate 70205 Sep 11 16:31 designate.conf -rw-r-----. 1 root designate 6060 Sep 11 16:31 policy.yaml -rw-r--r--. 1 root root 2125 Sep 11 16:44 pools.yaml drwxr-xr-x. 2 root root 60 Sep 11 17:41 private -rw-r-----. 1 root designate 949 Jul 8 2022 rootwrap.conf
$ ls -al /etc/designate/private/ total 12 drwxr-xr-x. 2 root root 60 Sep 11 17:41 . drwxr-xr-x. 1 root root 80 Sep 11 17:41 .. -rw-r--r--. 1 root root 196 Sep 11 16:27 bind1.conf -rw-r--r--. 1 root root 196 Sep 11 16:27 bind2.conf -rw-r--r--. 1 root root 196 Sep 11 16:27 bind3.conf
On the overcloud host: $ ls -al /var/lib/config-data/puppet-generated/designate/etc/designate/private/bind1.conf -rw-r--r--. 1 root root 196 Sep 11 16:27 /var/lib/config-data/puppet-generated/designate/etc/designate/private/bind1.conf
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2249273?
REDHAT-BUG-2249273 is classified as a security vulnerability due to world-readable permissions on sensitive configuration files.
How do I fix REDHAT-BUG-2249273?
To fix REDHAT-BUG-2249273, restrict the permissions of the /etc/designate directory and its files to prevent unauthorized access.
What are the potential risks associated with REDHAT-BUG-2249273?
The risks include unauthorized users gaining access to RNDC keys, which could lead to DNS manipulation or service disruptions.
Which versions of OpenStack Designate are affected by REDHAT-BUG-2249273?
All versions of OpenStack Designate that have not addressed the world-readable permissions issue are potentially affected by REDHAT-BUG-2249273.
Is there a workaround for REDHAT-BUG-2249273?
Temporarily securing the /etc/designate directory by changing file permissions can serve as a workaround until a formal patch is applied.