An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
| Link | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2024:2736 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2024:2770 | vendor advisory |
| https://access.redhat.com/security/cve/CVE-2023-6725 | vdb entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=2249273 | issue tracking |