CVE-2015-3156 Openstack DBaaS (Trove) Improper Link Resolution Before File Access
Local attackers can modify configuration files via symlink attacks on temporary files in OpenStack Trove, potentially compromising database services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3156?
CVE-2015-3156 is a medium-severity path traversal vulnerability in n/a, published on 11 Aug 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Weakness: CWE-59
Which versions are affected by CVE-2015-3156?
3 open source packages ship an affected version, including trove. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trove PyPI | All versions | 4.0.0a0 |
trove PyPI | All versions | 4.0.0a0 |
trove PyPI | All versions | 4.0.0a0 |
Linux distribution packages (2)
openstack-trove SUSE:OpenStack Cloud 5 | All versions | 2014.2.4.juno-15.1 |
openstack-trove-doc SUSE:OpenStack Cloud 5 | All versions | 2014.2.4.juno-15.1 |
Products include Openstack Trove.
How do I fix CVE-2015-3156?
Upgrade trove to 4.0.0a0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-3156 being exploited?
There is no known exploitation of CVE-2015-3156 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2015-3156, GHSA-98c8-36p9-gw66, PYSEC-2026-1053, SUSE-SU-2016:0739-1, UBUNTU-CVE-2015-3156.