PT-2019-5610

CVE-2019-3895

Published

2019-05-27

Updated

2022-05-24

Description by

CVSS 3.1

8.0

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Octavia (affected versions not specified)

Description An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. This flaw allows a remote attacker to upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations To prevent this vulnerability:

Update Octavia's configuration setting (octavia.conf) to amp image owner id = $UUID OF SERVICE PROJECT on all Octavia nodes.
Enable the new configuration by restarting both octavia worker and octavia health manager.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2019-3895

BDU:2020-04695

GHSA-JJGH-M322-FJX6

PYSEC-2019-194