CVE-2020-10755 : What You Need to Know

An insecure-credentials flaw in openstack-cinder versions exposes backend storage driver credentials, potentially leading to unauthorized access.

Understanding CVE-2020-10755

What is CVE-2020-10755?

This CVE identifies an insecure-credentials vulnerability in openstack-cinder versions that could allow unauthorized access to backend storage driver credentials.

The Impact of CVE-2020-10755

The vulnerability exposes credentials in the

connection_info

element, enabling attackers to access another user's volume and potentially the Management API.

Technical Details of CVE-2020-10755

Vulnerability Description

The flaw in openstack-cinder versions before 14.1.0, 15.x.x before 15.2.0, and 16.x.x before 16.1.0 exposes backend storage driver credentials.

Affected Systems and Versions

Red Hat's openstack-cinder versions before 14.1.0
All openstack-cinder 15.x.x versions before 15.2.0
All openstack-cinder 16.x.x versions before 16.1.0

Exploitation Mechanism

Credentials for the entire backend are exposed in the

connection_info

element
Attackers can retrieve usernames and passwords to access other user's volumes

Mitigation and Prevention

Immediate Steps to Take

Upgrade to openstack-cinder 14.1.0, 15.2.0, or 16.1.0
Restrict API access and implement strong access controls

Long-Term Security Practices

Regularly review and update access policies
Monitor API calls for unusual activities

Patching and Updates

Apply patches provided by Red Hat to fix the vulnerability