CVE-2016-9590 Information disclosure in puppet-swift
An information disclosure vulnerability in the puppet-swift module allows attackers to read sensitive configuration data due to world-readable file permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9590?
CVE-2016-9590 is a medium-severity vulnerability in Redhat Openstack, published on 26 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.
Weakness: CWE-200
Which versions are affected by CVE-2016-9590?
It affects 2 products.
Linux distribution packages (3)
puppet-swift Red Hat:openstack:10::el7 | All versions | 0:9.4.3-3.el7ost |
openstack-puppet-modules Red Hat:openstack:8::el7 | All versions | 1:7.1.5-2.el7ost |
openstack-puppet-modules Red Hat:openstack:9::el7 | All versions | 1:8.1.10-2.el7ost |
Products include Openstack Puppet-Swift, Redhat Openstack.
How do I fix CVE-2016-9590?
Upgrade to a fixed version.
Is CVE-2016-9590 being exploited?
There is no known exploitation of CVE-2016-9590 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-9590, GHSA-7q5j-cmrw-cmmc, RHSA-2017:0200, RHSA-2017:0359, RHSA-2017:0361, UBUNTU-CVE-2016-9590.