PT-2019-5610 · Openstack+1 · Openstack Octavia+1

Publicado 2019-05-27 · Atualizado 2022-05-24 · CVE-2019-3895

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Octavia (affected versions not specified)

Description An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. This flaw allows a remote attacker to upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations To prevent this vulnerability:

1. Update Octavia's configuration setting (octavia.conf) to amp image owner id = $UUID OF SERVICE PROJECT on all Octavia nodes.
2. Enable the new configuration by restarting both octavia worker and octavia health manager.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2020-04695

CVE-2019-3895

GHSA-JJGH-M322-FJX6

PYSEC-2019-194

RHSA-2019:1683

RHSA-2019:1742

Produtos afetados

Openstack Octavia

Red Hat Openstack Platform Director

Referências · 21

• https://github.com/pypa/advisory-database/tree/main/vulns/octavia/PYSEC-2019-194.yaml · Nota
• https://github.com/openstack/octavia/commit/d7d062a47ab54a540d81f13a0e5f3085ebfaa0d2 · Nota
• https://github.com/openstack/octavia · Nota
• https://github.com/openstack/octavia/blob/08570831754d9671fbd1756d668f55f191e47ca4/octavia/compute/drivers/nova_driver.py#L35 · Nota
• https://github.com/openstack/tripleo-common/commit/e7c5eab712e0f70ecbc6d225d4766e0fe0f3f884 · Nota
• https://access.redhat.com/errata/RHSA-2019:1742 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3895 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2019-3895 · Nota
• https://access.redhat.com/errata/RHSA-2019:1683 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-3895 · Aviso do Fabricante
• https://opendev.org/openstack/octavia/commit/d7d062a47ab54a540d81f13a0e5f3085ebfaa0d2 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-194 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-3895 · Aviso do Fabricante
• https://bugs.launchpad.net/octavia/+bug/1620629 · Nota
• https://bdu.fstec.ru/vul/2020-04695 · Nota de Segurança