In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:16.04:LTS designate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.0-0ubuntu1+esm1"}]}]

Ubuntu:Pro:18.04:LTS designate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.2+esm1"}]}]

Ubuntu:Pro:20.04:LTS designate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.2-0ubuntu1+esm1"}]}]

Ubuntu:22.04:LTS designate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.4-0ubuntu1.1"}]}]

Ubuntu:24.04:LTS designate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.0-0ubuntu1.1"}]}]

Ubuntu:26.04:LTS designate

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.0.0-0ubuntu2.1"}]}]

参照URL

advisory ubuntu.com
report ubuntu.com
report cve.org
report bugs.launchpad.net
report security.openstack.org
report launchpad.net
report openwall.com