CVE-2018-17954

crowbar provision leaks admin password to all nodes in cleartext

State: Published
Severity: 9.3 Critical
Published: Apr 3, 2020
Updated: Sep 16, 2024
Reserved: Oct 3, 2018

Description

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	microfocus

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
SUSE OpenStack Cloud 7SUSE	crowbar-core to before 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-Affected
SUSE OpenStack Cloud 8SUSE	ardana-cinder to before 8.0+git.1579279939.ee7da88-3.39.3, ardana-Affected
SUSE OpenStack Cloud 9SUSE	ardana-ansible to before 9.0+git.1581611758.f694f7d-3.16.1, ardana-Affected
SUSE OpenStack Cloud Crowbar 8SUSE	crowbar-core to before 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-Affected
SUSE OpenStack Cloud Crowbar 9SUSE	crowbar-core to before 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=1117080

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.