CVE-2023-6725

Advisory

Affected versions of the OpenStack Designate package are vulnerable to Information Disclosure due to world-readable RNDC configuration files that expose credentials for controlling BIND. In Red Hat OpenStack Platform 17.1 deployments generated by tripleo-ansible, the /etc/designate and /etc/designate/private directories and files such as /etc/designate/private/bind1.conf are installed with permissive modes, making the RNDC keys readable to any local user within the Designate container.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6725
• https://access.redhat.com/security/cve/CVE-2023-6725
• https://access.redhat.com/errata/RHSA-2024:2736