CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:openstack",
            "extracted_events": [
                {
                    "introduced": "8"
                },
                {
                    "last_affected": "8"
                },
                {
                    "introduced": "9"
                },
                {
                    "last_affected": "9"
                },
                {
                    "introduced": "10"
                },
                {
                    "last_affected": "10"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/openstack/puppet-swift

Affected ranges

Type

GIT

Repo

https://github.com/openstack/puppet-swift

Events

Introduced

7f8469a6c8a0dd600c81a5a4697b3e0dc873744d

Fixed

7ed0b70294a07e514fbd12a74a424de0c5bad0f5

Introduced

fbc530a9d3912ccaaa00df463237d1339e88be52

Fixed

f75979a613b1cc745e95498f10c69c4a421f271e

Database specific

{
    "cpe": "cpe:2.3:a:openstack:puppet-swift:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.2.1"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.4"
        }
    ]
}

Affected versions

8.*

8.0.0

8.1.0

8.2.0

9.*

9.0.0

9.1.0

9.2.0

9.3.0

9.4.0

9.4.1

9.4.2

9.4.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9590.json"