PT-2018-13771 · Openstack+1 · Openstack-Mistral+1

CVE-2018-16849 · Publicado 2018-11-02 · Atualizado 2025-04-28

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-mistral (affected versions not specified)

Description A flaw in openstack-mistral allows the disclosure of the presence of arbitrary files within the filesystem of the executor running the action. This is achieved by manipulating the SSH private key filename in the std.ssh action, which can take an absolute path to assess whether a file exists on the executor's filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-16849

GHSA-FQW7-C6VR-Q29M

PYSEC-2018-92

USN-7465-1

Produtos afetados

Ubuntu

Openstack-Mistral

Referências · 20

• https://github.com/openstack/mistral · Nota
• https://github.com/openstack/mistral/commit/2309e5265a1d5f28480ae872817b5de05f66e83c · Nota
• https://github.com/openstack/mistral/commit/c93b45a61f49d4633f76d8e117cd89063e7759c4 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/mistral/PYSEC-2018-92.yaml · Nota
• https://osv.dev/vulnerability/GHSA-fqw7-c6vr-q29m · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-16849 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16849 · Aviso do Fabricante
• https://bugs.launchpad.net/mistral/+bug/1783708 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16849 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-7465-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16849 · Aviso do Fabricante
• https://github.com/advisories/GHSA-fqw7-c6vr-q29m · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16849 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-16848 · Aviso do Fabricante