CVE-2017-12155 — tripleo-heat-templates
MEDIUMCVE-2017-12155 is a medium-severity (CVSS 6.3) Missing Authentication vulnerability in tripleo-heat-templates. A fix is available for tripleo-heat-templates — see the affected versions and patch details below.
Openstack tripleo-heat-templates unauthenticated file access
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
tripleo-heat-templatesReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | tripleo-heat-templates | all versions | 7.0.6pip install --upgrade 'tripleo-heat-templates==7.0.6' |
Affected Products
cephcephDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for tripleo-heat-templates, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update tripleo-heat-templates to 7.0.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2017-12155 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
To mitigate the flaw, use an overcloud post-deploy script[1] to do the following on all overcloud nodes: key=/etc/ceph/ceph.client.openstack.keyring chown root:root $key chmod 600 $key setfacl -m u:glance:r $key setfacl -m u:cinder:r $key setfacl -m u:nova:r $key setfacl -m u: gnocchi:r $key If not using Red Hat OpenStack Platform director, then run the commands above manually on each overcloud node, Warning: Only running 'chmod 600 $key' alone (without an ACL) will prevent OpenStack from reading the key. [1] https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/11/html-single/advanced_overcloud_customization/#sect-Customizing_Overcloud_PostConfiguration_AllSource: Red Hat security advisory for CVE-2017-12155 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat OpenStack Platform 10.0 (Newton) | openstack-tripleo-heat-templates-0:5.3.10-1.el7ost | RHSA-2018:1593 |
| Red Hat OpenStack Platform 11.0 (Ocata) | openstack-tripleo-heat-templates-0:6.2.12-2.el7ost | RHSA-2018:1627 |
| Red Hat OpenStack Platform 12.0 (Pike) | openstack-tripleo-heat-templates-0:7.0.9-8.el7ost | RHSA-2018:0602 |
Frequently Asked Questions
Is CVE-2017-12155 in your dependencies?
Find it across PyPI, including transitive dependencies.