Multiple vulnerabilities in Service Telemetry Framework 1.5

1) Resource exhaustion

EUVDB-ID: #VU88184

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-45288

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single HTTP/2 stream. A remote attacker can send specially crafted HTTP/2 requests to the server and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Integer overflow

EUVDB-ID: #VU63553

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-43618

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in mpz/inp_raw.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Off-by-one

EUVDB-ID: #VU69807

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3821

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the format_timespan() function in time-util.c. A local user can trigger an off-by-one error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Privilege Management

EUVDB-ID: #VU70461

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-4415

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper privilege management when handling coredumps in coredump/coredump.c. A local user can gain access to sensitive information.

The vulnerability affects systems with libacl support.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU84985

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-7104

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the sessionReadRecord() function in ext/session/sqlite3session.c when processing a corrupt changeset. A remote user can send a specially crafted request to trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper Privilege Management

EUVDB-ID: #VU74146

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-26604

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information Exposure Through Timing Discrepancy

EUVDB-ID: #VU85623

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0553

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform timing attack.

The vulnerability exists due to the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. A remote attacker can perform timing sidechannel attack in RSA-PSK key exchange.

Note, the vulnerability exists due to incomplete fox for #VU83316 (CVE-2023-5981).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Service Telemetry Framework: 1.5 - 1.5.3

CPE2.3

• cpe:2.3:a:red_hat:service_telemetry_framework:1.5:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.1:*:*:*:*:red_hat_openstack:*:
• cpe:2.3:a:red_hat:service_telemetry_framework:1.5.2:*:*:*:*:red_hat_openstack:*:

External links

http://access.redhat.com/errata/RHSA-2024:2062

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.