PT-2018-12620 · Red Hat · Red Hat Openstack+1

Publicado 2018-09-10 · Atualizado 2021-08-04 · CVE-2018-14620

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack RabbitMQ container image versions as shipped with Red Hat Openstack 12, 13, 14

Description The issue arises from the insecure retrieval of the rabbitmq clusterer component over HTTP during the build stage of the OpenStack RabbitMQ container image. This could potentially allow an attacker to serve malicious code to the image builder, resulting in the installation of malicious code in the resultant container image.

Recommendations For versions as shipped with Red Hat Openstack 12, 13, 14, consider disabling the insecure retrieval of the rabbitmq clusterer component over HTTP as a temporary workaround until a patch is available. Restrict access to the build stage of the OpenStack RabbitMQ container image to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-494

CWE-20

Identificadores relacionados

CVE-2018-14620

Produtos afetados

Openstack Rabbitmq

Red Hat Openstack

Referências · 5

• https://access.redhat.com/errata/RHSA-2018:2729 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2721 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14620 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14620 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14620 · Aviso do Fabricante