A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in its scope, it deletes other existing access rules which are not associated with any application credentials.
Weakness
The product does not handle or incorrectly handles inputs that are related to complex structures.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat OpenStack Platform 17.1 for RHEL 8 | RedHat | python-openstackclient-0:5.5.2-17.1.20230829213816.el8ost | * |
| Red Hat OpenStack Platform 17.1 for RHEL 9 | RedHat | python-openstackclient-0:5.5.2-17.1.20230829210830.el9ost | * |
| Python-openstackclient | Ubuntu | bionic | * |
| Python-openstackclient | Ubuntu | esm-infra/focal | * |
| Python-openstackclient | Ubuntu | focal | * |
| Python-openstackclient | Ubuntu | jammy | * |
| Python-openstackclient | Ubuntu | trusty | * |
| Python-openstackclient | Ubuntu | xenial | * |
References
- https://access.redhat.com/errata/RHSA-2024:2737
- https://access.redhat.com/errata/RHSA-2024:2769
- https://access.redhat.com/security/cve/CVE-2023-6110
- https://bugzilla.redhat.com/show_bug.cgi?id=2212960
- https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf
- https://review.opendev.org/c/openstack/python-openstackclient/+/888697