Skip to content
Fencer Vulns
critical 9.9

CVE-2017-2637 json

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration.

published 2018-07-26 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11798

cvss
9.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.6%
EPSS 4.6% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.

Patch / fix

  • python-tripleoclient openstack-director 9 2.0.0-14.el7ost
  • openstack-tripleo-heat-templates openstack-director 9 2.0.0-57.el7ost
  • openstack-tripleo-puppet-elements openstack-director 9 2.0.0-6.el7ost
  • openstack-tripleo-heat-templates-liberty openstack-director 9 2.0.0-57.el7ost
  • puppet-nova openstack 10 9.5.0-4.el7ost
  • python-nova openstack 10 1:14.0.3-9.el7ost
  • openstack-nova openstack 10 1:14.0.3-9.el7ost
  • puppet-tripleo openstack 10 5.5.0-12.el7ost

red hat advisories RHSA-2017:1504RHSA-2017:1242RHSA-2017:1546RHSA-2017:1537

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-2637 updated cvss 9.9

rhosp-director: libvirtd is deployed with no authentication

  • Red Hat OpenStack 7.0 Director for RHEL 7 python-rdomanager-oscplugin 0.0.10-34.el7ost, openstack-tripleo-puppet-elements 0.0.1-6.el7ost, openstack-tripleo-heat-templates 0.8.6-135.el7ost
    fixed: vendor fix “A KCS article with more details on this flaw is available at: https://access.redhat.com/solutions/3022771” RHSA-2017:1537
  • Red Hat OpenStack 8.0 Director for RHEL 7 python-tripleoclient 0.3.4-14.el7ost, openstack-tripleo-puppet-elements 0.0.5-2.el7ost, openstack-tripleo-heat-templates 0.8.14-29.el7ost, openstack-tripleo-heat-templates-kilo 0.8.14-29.el7ost
    fixed: vendor fix “A KCS article with more details on this flaw is available at: https://access.redhat.com/solutions/3022771” RHSA-2017:1546
  • Red Hat OpenStack 9.0 Director for RHEL 7 python-tripleoclient 2.0.0-14.el7ost, openstack-tripleo-heat-templates 2.0.0-57.el7ost, openstack-tripleo-puppet-elements 2.0.0-6.el7ost, openstack-tripleo-heat-templates-liberty 2.0.0-57.el7ost
    fixed: vendor fix “A KCS article with more details on this flaw is available at: https://access.redhat.com/solutions/3022771” RHSA-2017:1504
  • Red Hat OpenStack Platform 10.0 puppet-nova 9.5.0-4.el7ost, python-nova 14.0.3-9.el7ost, openstack-nova 14.0.3-9.el7ost, puppet-tripleo 5.5.0-12.el7ost, python-nova-tests 14.0.3-9.el7ost, openstack-nova-api 14.0.3-9.el7ost, +16 more
    fixed: vendor fix “A KCS article with more details on this flaw is available at: https://access.redhat.com/solutions/3022771” RHSA-2017:1242
  • Red Hat OpenStack Platform 11 (Ocata) python-tripleoclient
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.60% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
NVD 3.0 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • [UNKNOWN] rhosp-director

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.