CVE-2016-9599

Name of the Vulnerable Software and Affected Versions puppet-tripleo versions prior to 5.5.0 puppet-tripleo versions prior to 6.2.0

Description The issue is related to an access-control flaw in the IPtables rules management, which allows the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could potentially use these open ports to gain access to unauthorized resources.

Recommendations For versions prior to 5.5.0, update to version 5.5.0 or later to resolve the issue. For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPtables rules management until a patch is available.