CVE-2017-2637 Auth bypass in rhosp-director
Attackers can bypass authentication to control virtual machines or take over hosts via unsecured libvirtd connections in OpenStack director deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-2637?
CVE-2017-2637 is a critical authentication bypass vulnerability in Redhat Openstack, published on 26 Jul 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
Weakness: CWE-306
Which versions are affected by CVE-2017-2637?
It affects 1 product.
Linux distribution packages (33)
openstack-tripleo-heat-templates Red Hat:openstack-director:7::el7 | All versions | 0:0.8.6-135.el7ost |
openstack-tripleo-puppet-elements Red Hat:openstack-director:7::el7 | All versions | 0:0.0.1-6.el7ost |
python-rdomanager-oscplugin Red Hat:openstack-director:7::el7 | All versions | 0:0.0.10-34.el7ost |
openstack-tripleo-heat-templates Red Hat:openstack-director:8::el7 | All versions | 0:0.8.14-29.el7ost |
openstack-tripleo-heat-templates-kilo Red Hat:openstack-director:8::el7 | All versions | 0:0.8.14-29.el7ost |
openstack-tripleo-puppet-elements Red Hat:openstack-director:8::el7 | All versions | 0:0.0.5-2.el7ost |
python-tripleoclient Red Hat:openstack-director:8::el7 | All versions | 0:0.3.4-14.el7ost |
openstack-tripleo-heat-templates Red Hat:openstack-director:9::el7 | All versions | 0:2.0.0-57.el7ost |
openstack-tripleo-heat-templates-liberty Red Hat:openstack-director:9::el7 | All versions | 0:2.0.0-57.el7ost |
openstack-tripleo-puppet-elements Red Hat:openstack-director:9::el7 | All versions | 0:2.0.0-6.el7ost |
python-tripleoclient Red Hat:openstack-director:9::el7 | All versions | 0:2.0.0-14.el7ost |
openstack-nova Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-api Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-cells Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-cert Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-common Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-compute Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-conductor Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-console Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-migration Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-network Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-novncproxy Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-placement-api Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-scheduler Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-serialproxy Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-nova-spicehtml5proxy Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
openstack-tripleo-common Red Hat:openstack:10::el7 | All versions | 0:5.4.1-6.el7ost |
openstack-tripleo-heat-templates Red Hat:openstack:10::el7 | All versions | 0:5.2.0-15.el7ost |
openstack-tripleo-puppet-elements Red Hat:openstack:10::el7 | All versions | 0:5.2.0-3.el7ost |
puppet-nova Red Hat:openstack:10::el7 | All versions | 0:9.5.0-4.el7ost |
puppet-tripleo Red Hat:openstack:10::el7 | All versions | 0:5.5.0-12.el7ost |
python-nova Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
python-nova-tests Red Hat:openstack:10::el7 | All versions | 1:14.0.3-9.el7ost |
Products include Redhat Openstack.
How do I fix CVE-2017-2637?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-2637 being exploited?
There is no known exploitation of CVE-2017-2637 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
Sources
Also known as GHSA-w8fq-h7pg-632c, RHSA-2017:1242, RHSA-2017:1504, RHSA-2017:1537, RHSA-2017:1546.