Access Control Flaw in Octavia Service for Red Hat OpenStack Platform
CVE-2019-3895

5.5MEDIUM

Key Information:

Vendor
Red Hat
Status
Openstack-tripleo-common
Vendor
CVE Published:
3 June 2019

Summary

An access-control flaw in the Octavia service allows attackers to deploy vulnerable amphorae images in the Red Hat OpenStack Platform. This flaw lets remote attackers upload compromised images which, when spawning new amphorae, Octavia unwittingly utilizes, potentially leading to security breaches and elevated privileges.

Affected Version(s)

openstack-tripleo-common

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895
x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:1683
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1742
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.