VDB

CVE-2017-15114

CVE-2017-15114 PUBLISHED

When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services. As no additional authentication is configured this allows these services to connect to libvirtd (which is equivalent to root access). If a vulnerability exists in another service it could, combined with this flaw, be exploited to escalate privileges to gain control over compute nodes.

EPSS 0.87% · 75.6th percentile

Risk Scores

EPSS Score
0.87%
75.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTStripleo-heat-templates0, 0.6.1-1
Ubuntu:18.04:LTStripleo-heat-templates5.2.0-1, 0

Timeline

  • Nov 27, 2017 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Feb 28, 2022 EPSS Score
  • May 2, 2022 EPSS Score
  • Jul 3, 2022 EPSS Score
  • Sep 5, 2022 EPSS Score
  • Nov 6, 2022 EPSS Score
  • Jan 8, 2023 EPSS Score
Open in Interactive Console →
$ Console Community · 100/wk Open console ›