Information Disclosure Vulnerability in OpenStack Mistral by Red Hat
CVE-2018-16849

3.1LOW

Key Information:

Vendor

[unknown]

Status
Openstack-mistral
Vendor
CVE Published:
2 November 2018

What is CVE-2018-16849?

A vulnerability in OpenStack Mistral allows an attacker to exploit the std.ssh action by manipulating the SSH private key filename. This can enable the disclosure of the presence of arbitrary files in the filesystem of the executor. By providing an absolute path for the std.ssh private_key_filename, an attacker may confirm the existence of files, thereby exposing sensitive data and potentially compromising the security of the execution environment.

Affected Version(s)

openstack-mistral

References

https://bugs.launchpad.net/mistral/+bug/1783708
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.