GHSA-m94p-8942-pm49

OpenStack TripleO Heat templates spoof metadata requests

Source: GitHub Advisory Database (reviewed) High CVE-2015-5303

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	tripleo-heat-templates	< 0.8.10	0.8.10

Details

As written in the advisory (Markdown source, shown as plain text).

The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-5303 advisory
https://github.com/openstack/tripleo-heat-templates/commit/1a0c7d97165c1b38dc9f78b82ac6ec8519fcf80c web
https://github.com/openstack/tripleo-heat-templates/commit/293f19b2a41386e1eea47a9e6add24b006c69c42 web
https://access.redhat.com/errata/RHSA-2015:2650 web
https://bugs.launchpad.net/tripleo/+bug/1516027 web
https://github.com/openstack/tripleo-heat-templates package
https://github.com/pypa/advisory-database/tree/main/vulns/tripleo-heat-templates/PYSEC-2016-35.yaml web
https://opendev.org/openstack/tripleo-heat-templates/commit/1a0c7d97165c1b38dc9f78b82ac6ec8519fcf80c web
https://opendev.org/openstack/tripleo-heat-templates/commit/293f19b2a41386e1eea47a9e6add24b006c69c42 web