CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2015-1842

Description

It was discovered that the puppet manifests, as provided with the openstack-puppet-modules package, would configure the pcsd daemon with a known default password. If this password was not changed and an attacker was able to gain access to pcsd, they could potentially run shell commands as root.

Statement

Red Hat Product Security has rated this issue as having Important security impact, a future update will address the flaw.

As a mitigation against this issue, any system deployed using the affected component should have the 'hacluster' password changed before being placed into production or on an untrusted network.

An article with more detailed information is available to customers here: https://access.redhat.com/articles/1396123

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v2 Score Breakdown

Red HatNVDcve.org
Base Score9.310N/A
Attack VectorNetworkNetworkN/A
Access ComplexityMediumLowN/A
AuthenticationNoneNoneN/A
Confidentiality ImpactCompleteCompleteN/A
Integrity ImpactCompleteCompleteN/A
Availability ImpactCompleteCompleteN/A

Vector

Red Hat: AV:N/AC:M/Au:N/C:C/I:C/A:C

NVD: AV:N/AC:L/Au:N/C:C/I:C/A:C

Acknowledgements

This issue was discovered by Alessandro Vozza (Red Hat).

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.