Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2016-9599: Puppet‑Tripleo can create open network ports
CVE-2016-9599 · published 8 years ago
Summary
The OpenStack puppet-tripleo module (versions before 5.5.0 and 6.2.0) lets users add firewall rules without specifying a port, leaving TCP/UDP ports open. If SSL is turned on, an attacker could use those open ports to reach resources they should not access. Upgrade to the latest puppet-tripleo release to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openstack | puppet-tripleo |
5.5.0 6.2.0 cpe:2.3:a:openstack:puppet-tripleo:5.5.0:*:*:*:*:*:*:* |
| redhat | openstack |
10 cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* |
Original advisory text
puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is e...
puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could use these open ports to gain access to unauthorized resources.
References
- http://rhn.redhat.com/errata/RHSA-2017-0025.html Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9599 Issue Tracking Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-284Improper Access Control
Timeline
Published24 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-9599 · NVD
Track software like this
Free during beta