(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. Per http://rhn.redhat.com/errata/RHSA-2013-0595.html these are the affected products:
Red Hat OpenStack Essex
Red Hat OpenStack Folsom
Publication date: Sat, 09 Mar 2013 03:55:00 +0000