RHEL 6 : openstack-packstack (RHSA-2014:1691)

critical Nessus Plugin ID 210205

Synopsis

The remote Red Hat host is missing a security update.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1691 advisory.

PackStack is a command-line utility that uses Puppet modules to support rapid deployment of OpenStack on existing servers over an SSH connection.
PackStack is suitable for deploying both single node proof-of-concept installations and more complex multi-node installations.

It was discovered that the nova.conf configuration generated by PackStack did not correctly set the libvirt_vif_driver configuration option if the Open vSwitch (OVS) monolithic plug-in was not used. This could result in deployments defaulting to having the firewall disabled unless the nova configuration was manually modified after PackStack was started.
(CVE-2014-3703)

This issue was discovered by Yair Fried of Red Hat.

This update also fixes the following bug:

* This update fixes a dependency issue between the openstack-cinder-api and openstack-cinder-backup services. The openstack-cinder-backup service is now guaranteed to be started during PackStack installation. (BZ#1075609)

In addition, this update adds the following enhancements:

* This update enables mysqld performance improvement if users add the following configuration options to the /etc/my.cnf file:

innodb_buffer_pool_size = (10-20% of available memory) innodb_flush_method = O_DIRECT innodb_file_per_table

These improvements are expected to be the default settings in the next release. (BZ#1078999)

* With this update, PackStack now consistently performs the installation of the sos, sos-plugins-openstack, and rhos-collector packages on all hosts.
(BZ#1131619)

All openstack-packstack users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected openstack-packstack, openstack-packstack-doc and / or openstack-packstack-puppet packages.

Plugin Details

Severity: Critical

ID: 210205

File Name: redhat-RHSA-2014-1691.nasl

Version: 1.1

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 11/4/2024

Updated: 11/4/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2014-3703

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:openstack-packstack-puppet, p-cpe:/a:redhat:enterprise_linux:openstack-packstack-doc, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:openstack-packstack

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2014

Vulnerability Publication Date: 10/22/2014

Reference Information

CVE: CVE-2014-3703

RHSA: 2014:1691

Detections

Analytics