Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2022-38060: OpenStack Kolla Privilege Escalation Risk Through Sudo Misconfiguration
CVE-2022-38060 · published 3 years ago
Summary
A misconfigured sudo setting in OpenStack Kolla containers can allow unauthorized access to elevated system privileges. This could enable an attacker to gain access to sensitive system areas. To ensure security, review and update sudo settings in container configurations.
What to do
- Update openstack kolla to version 15.0.0.0rc1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | openstack | kolla |
< 15.0.0.0rc1 Fix: upgrade to 15.0.0.0rc1
|
| – | openstack | kolla |
All versions
cpe:2.3:a:openstack:kolla:-:*:*:*:*:*:*:* |
Original advisory text
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-38060
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1589
- https://github.com/openstack/kolla/commit/2a4a8fce31c12114e8f472c24dd96864b5bd2b...
- https://bugs.launchpad.net/kolla/+bug/1985784
- https://bugzilla.redhat.com/show_bug.cgi?id=2124758
- https://github.com/advisories/GHSA-rvxr-pf5f-j2qj
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-269Improper Privilege Management
CWE-426Untrusted Search Path
Timeline
Published21 Dec 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta