PT-2019-5610

CVE-2019-3895

تاريخ النشر

2019-05-27

تاريخ التحديث

2022-05-24

الوصف من

CVSS 3.1

8.0

عالية

المقاييسAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Octavia (affected versions not specified)

Description An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. This flaw allows a remote attacker to upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations To prevent this vulnerability:

Update Octavia's configuration setting (octavia.conf) to amp image owner id = $UUID OF SERVICE PROJECT on all Octavia nodes.
Enable the new configuration by restarting both octavia worker and octavia health manager.

قابلية الاستغلال

إصلاح

التأثيرات

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف

CWE-284: Improper Access Control

المعرّفات ذات الصلة

CVE-2019-3895

BDU:2020-04695

GHSA-JJGH-M322-FJX6

PYSEC-2019-194