VDB
CVE-2017-2637
CVE-2017-2637
PUBLISHED
CVSS 9.899999618530273 CRITICAL
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
EPSS 4.28% · 90.4th percentile
Risk Scores
CVSS 3.0
9.899999618530273
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS Score
4.28%
90.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| [UNKNOWN] | rhosp-director | n/a |
| redhat | openstack | 8, 9, 10 |
Timeline
- Jul 26, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Feb 3, 2023 EPSS Score
- Feb 13, 2023 EPSS Score
References
- https://wiki.openstack.org/wiki/OSSN/OSSN-0007 url
- RHSA-2017:1504 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2637 url
- https://nvd.nist.gov/vuln/detail/CVE-2017-2637 advisory
- https://access.redhat.com/security/cve/CVE-2017-2637 url
- https://bugzilla.redhat.com/show_bug.cgi?id=1428240 url
- http://www.securityfocus.com/bid/98576 url
- https://access.redhat.com/solutions/3022771 advisory
- https://access.redhat.com/errata/RHSA-2017:1242 advisory
- https://access.redhat.com/errata/RHSA-2017:1537 advisory
- https://access.redhat.com/errata/RHSA-2017:1546 advisory