CVE-2019-3895
High
Description
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
SeverityHigh
CVSS8.0
Exploit probability—
Product
Openstack Octavia
PublishedJun 3, 2019
First seenJun 3, 2019
Weakness typeCWE-284Improper access control
How to fix
Update
- openstack octavia0.9.0 or later
- octavia0.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openstack octavia | v < 0.9.0 | 0.9.0 |
| redhat openstack | 12 | — |
| octaviaPyPI | v < 0.9.0 | 0.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.