Read the docs
TI-2022-03309 Aliases CVE-2022-3596GHSA-788f-3f4f-vv6f

Instack-undercloud: rsync leaks information to undercloud

Priority LOW 35CWE-402Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01107 66th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat OpenStack Platform 13.0 - ELS—8.4.9-13.el7ostPatch availableCNA
Red HatRed Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS—8.4.9-13.el7ostPatch availableCNA
  • Red Hat OpenStack Platform 13.0 - ELS VendorRed Hat Affected — Fixed in 8.4.9-13.el7ost Patch available CNA
  • Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS VendorRed Hat Affected — Fixed in 8.4.9-13.el7ost Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*13.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:els:*:*:*13.0VulnerableRed Hat
  • cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:els:*:*:* Versions 13.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2022:8897 Released 2022-12-08 · Red Hat rating Important
    Red Hat OpenStack Platform 13.0 (instack-undercloud) security update
    • Red Hat OpenStack Platform 13.0 - ELS instack-undercloud-8.4.9-13.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server instack-undercloud-8.4.9-13.el7ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2022:8897
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2022:8897

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3596
  2. 2026-10-03 Alias added: GHSA-788f-3f4f-vv6f

References

Advisory 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2023-01529 Information leak in api CVSS 3.1HIGH 7.4
  • TI-2022-03027 Uncontrolled resource consumption in openstack-neutron CVSS 3.1MEDIUM 6.5
  • TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
  • TI-2023-01565 A flaw was found in openvswitch (OVS). CVSS 3.1HIGH 8.2
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences