manifests/base.pp in the puppetlabs-cinder module, as... · CVE-2013-0266 · GitHub Advisory Database · GitHub

manifests/base.pp in the puppetlabs-cinder module, as...

Low severity Unreviewed Published May 5, 2022 to the GitHub Advisory Database • Updated Apr 30, 2026

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.

References

Published by the National Vulnerability Database

Mar 8, 2013

Published to the GitHub Advisory Database May 5, 2022

Last updated Apr 30, 2026

Weaknesses

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files. Learn more on MITRE.

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. Learn more on MITRE.