VulnerabilityModified
CVE-2019-3895
An attacker could cause new amphorae to run based on any arbitrary image.
HIGH 8.0EPSS 1.43%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.43% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- openstack/octavia · redhat/openstack
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2019:1683Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1742Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895Issue Tracking, Mitigation, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1683Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1742Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895Issue Tracking, Mitigation, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.