PYSEC-2016-34

vendorUSosv

view advisory published 2016-04-15Licence: CC-BY-4.0

The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-5271US	high7.5	2.44% (84th)	—	2016-04-15
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the sw…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/errata/RHSA-2015:1862ADVISORY
https://bugs.launchpad.net/tripleo/+bug/1494896WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1261697REPORT
https://github.com/advisories/GHSA-8936-44gw-7664ADVISORY
https://launchpadlibrarian.net/217268516/CVE-2015-5271_puppet-swift.patchWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan