A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kolla | Openstack | - (including) | - (including) |
| Red Hat OpenStack Platform 17.1 for RHEL 8 | RedHat | openstack-tripleo-common-0:15.4.1-17.1.20230927003755.el8ost | * |
| Red Hat OpenStack Platform 17.1 for RHEL 9 | RedHat | openstack-tripleo-common-0:15.4.1-17.1.20230927010819.el9ost | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html