Red Hat Openstack Platform 17 1
Monthly
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Pacemaker Configuration System (PCS) on Red Hat Enterprise Linux 8, 9, and 10 exposes an arbitrary file-read primitive to local members of the 'haclient' group via the `pcs host auth --token` command. The pcsd daemon reads the attacker-specified file path with root privileges, base64-encodes up to 256 bytes of content, and transmits it through cluster node communication channels the attacker controls - enabling exfiltration of short sensitive files such as API tokens, symmetric keys, or credential snippets that are otherwise inaccessible to the attacker. No public exploit has been identified at time of analysis, but the attack requires only local access and group membership, making it a realistic insider-privilege escalation threat in multi-tenant HA environments.
Unconditional TLS certificate validation disabling in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection exposes HTTP Basic-Auth credentials to interception and permits response tampering against any managed OCAPI storage or enclosure device. Because the shared request helper disables certificate validation on every call with no parameter to re-enable it, a network-adjacent attacker performing a MITM attack can present any certificate, silently capture credentials, and inject falsified device responses back to the Ansible controller. Red Hat bundles the affected collection in Ceph Storage 5 and 9 and OpenStack Platform 17.1 and 18.0; no public exploit has been identified at time of analysis.
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Pacemaker Configuration System (PCS) on Red Hat Enterprise Linux 8, 9, and 10 exposes an arbitrary file-read primitive to local members of the 'haclient' group via the `pcs host auth --token` command. The pcsd daemon reads the attacker-specified file path with root privileges, base64-encodes up to 256 bytes of content, and transmits it through cluster node communication channels the attacker controls - enabling exfiltration of short sensitive files such as API tokens, symmetric keys, or credential snippets that are otherwise inaccessible to the attacker. No public exploit has been identified at time of analysis, but the attack requires only local access and group membership, making it a realistic insider-privilege escalation threat in multi-tenant HA environments.
Unconditional TLS certificate validation disabling in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection exposes HTTP Basic-Auth credentials to interception and permits response tampering against any managed OCAPI storage or enclosure device. Because the shared request helper disables certificate validation on every call with no parameter to re-enable it, a network-adjacent attacker performing a MITM attack can present any certificate, silently capture credentials, and inject falsified device responses back to the Ansible controller. Red Hat bundles the affected collection in Ceph Storage 5 and 9 and OpenStack Platform 17.1 and 18.0; no public exploit has been identified at time of analysis.