PT-2019-5610

CVE-2019-3895

Publicado

2019-05-27

Atualizado

2022-05-24

Descrição por

CVSS 3.1

8.0

Alta

MétricasAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Octavia (affected versions not specified)

Description An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. This flaw allows a remote attacker to upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations To prevent this vulnerability:

Update Octavia's configuration setting (octavia.conf) to amp image owner id = $UUID OF SERVICE PROJECT on all Octavia nodes.
Enable the new configuration by restarting both octavia worker and octavia health manager.

Explorabilidade

Correção

Impactos

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-284: Improper Access Control

Identificadores relacionados

CVE-2019-3895

BDU:2020-04695

GHSA-JJGH-M322-FJX6

PYSEC-2019-194