Read the docs
TI-2015-01654 Aliases CVE-2015-1842GHSA-x735-34cq-fm2q

The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2…

Priority MEDIUM 51CWE-255Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.

Why it matters now

EPSS 0.05179 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openstack:*:*:*:*:*:*:*:*up to 6.0VulnerableRed Hat
  • cpe:2.3:a:redhat:openstack:*:*:*:*:*:*:*:* Versions up to 6.0 Vulnerable ·Red Hat

Remediation

Red Hat 5 advisories

  • RHSA-2015:0831 Released 2015-04-16 · Red Hat rating Important
    openstack-packstack and openstack-puppet-modules update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-packstack-2014.1.1-0.46.dev1280.el7ost, openstack-packstack-doc-2014.1.1-0.46.dev1280.el7ost, openstack-packstack-puppet-2014.1.1-0.46.dev1280.el7ost +1
  • RHSA-2015:0832 Released 2015-04-16 · Red Hat rating Important
    openstack-packstack and openstack-puppet-modules update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-packstack-2014.1.1-0.46.dev1280.el6ost, openstack-packstack-doc-2014.1.1-0.46.dev1280.el6ost, openstack-packstack-puppet-2014.1.1-0.46.dev1280.el6ost +1
  • RHSA-2015:0830 Released 2015-04-16 · Red Hat rating Important
    openstack-foreman-installer security update
    • OpenStack Foreman augeas-1.0.0-7.el6_6.1, openstack-foreman-installer-2.0.34-1.el6ost, openstack-puppet-modules-2014.1.2-1.el6ost +3
Show 2 more Red Hat advisories
  • RHSA-2015:0789 Released 2015-04-07 · Red Hat rating Important
    openstack-packstack and openstack-puppet-modules security and bug fix update
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-packstack-2014.2-0.20.dev1467.g70c9655.el7ost, openstack-packstack-doc-2014.2-0.20.dev1467.g70c9655.el7ost, openstack-packstack-puppet-2014.2-0.20.dev1467.g70c9655.el7ost +1
  • RHSA-2015:0791 Released 2015-04-07 · Red Hat rating Important
    Red Hat Enterprise Linux OpenStack Platform Installer update
    • OpenStack 6 Installer for RHEL 7 foreman-discovery-image-7.0-20150227.0.el7ost, foreman-proxy-1.6.0.30-6.el7ost, openstack-foreman-installer-3.0.22-1.el7ost +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 4AffectedNo fix yet
OpenStack 6 Installer for RHEL 7Fixed RHSA-2015:0791
OpenStack ForemanFixed RHSA-2015:0830
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2015:0832
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2015:0831
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2015:0789

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1842
  2. 2026-10-03 Alias added: GHSA-x735-34cq-fm2q

References

Advisory 5

Other 1

  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2018-07980 Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis… CVSS 3.0CRITICAL 9.8
  • TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43. CVSS 3.1HIGH 7.5
  • TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2018-15768 Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume… CVSS 3.0HIGH 7.5
  • TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
See all 209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences