CVE-2023-6110 Openstack: deleting a non existing access rule deletes another existing access rule in it's scope
Attackers can delete unrelated access rules by attempting to delete a non-existent one, compromising identity management integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-6110?
CVE-2023-6110 is a medium-severity vulnerability in Red Hat OpenStack Platform 16.1, published on 17 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.
Weakness: CWE-237
Which versions are affected by CVE-2023-6110?
3 open source packages ship an affected version, including python-openstackclient.
| Package | Affected | Fixed in |
|---|---|---|
python-openstackclient PyPI | All versions | 6.3.0 |
python-openstackclient PyPI | All versions | 6.3.0 |
python-openstackclient PyPI | All versions | 6.3.0 |
Linux distribution packages (6)
python-openstackclient Red Hat:openstack:17.1::el8 | All versions | 0:5.5.2-17.1.20230829213816.el8ost |
python-openstackclient-lang Red Hat:openstack:17.1::el8 | All versions | 0:5.5.2-17.1.20230829213816.el8ost |
python3-openstackclient Red Hat:openstack:17.1::el8 | All versions | 0:5.5.2-17.1.20230829213816.el8ost |
python-openstackclient Red Hat:openstack:17.1::el9 | All versions | 0:5.5.2-17.1.20230829210830.el9ost |
python-openstackclient-lang Red Hat:openstack:17.1::el9 | All versions | 0:5.5.2-17.1.20230829210830.el9ost |
python3-openstackclient Red Hat:openstack:17.1::el9 | All versions | 0:5.5.2-17.1.20230829210830.el9ost |
How do I fix CVE-2023-6110?
Upgrade python-openstackclient to 6.3.0 or later.
Is CVE-2023-6110 being exploited?
There is no known exploitation of CVE-2023-6110 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2023-6110, GHSA-2ppf-2m6f-6v6f, PYSEC-2026-1853, RHSA-2024:2737, RHSA-2024:2769, UBUNTU-CVE-2023-6110 and 1 more.