CVE-2021-4180

Advisory

Tripleo-heat-templates 11.6.1 includes a fix for CVE-2021-4180: An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1. See CVE-2021-4180.


MISC:https://bugzilla.redhat.com/show_bug.cgi?id=2035793: https://bugzilla.redhat.com/show_bug.cgi?id=2035793

Resources

• https://bugzilla.redhat.com/show_bug.cgi?id=2035793
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4180