CVE-2018-16849
Low
Description
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
SeverityLow
CVSS3.1
Exploit probability—
Product
Redhat Openstack-mistral
PublishedNov 2, 2018
First seenNov 2, 2018
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- redhat openstack-mistral7.0.1 or later
- mistral7.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat openstack-mistral | v < 7.0.1 | 7.0.1 |
| mistralPyPI | v < 7.0.1 | 7.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.