PT-2018-12620 · Red Hat · Red Hat Openstack+1

Published 2018-09-10 · Updated 2021-08-04 · CVE-2018-14620

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack RabbitMQ container image versions as shipped with Red Hat Openstack 12, 13, 14

Description The issue arises from the insecure retrieval of the rabbitmq clusterer component over HTTP during the build stage of the OpenStack RabbitMQ container image. This could potentially allow an attacker to serve malicious code to the image builder, resulting in the installation of malicious code in the resultant container image.

Recommendations For versions as shipped with Red Hat Openstack 12, 13, 14, consider disabling the insecure retrieval of the rabbitmq clusterer component over HTTP as a temporary workaround until a patch is available. Restrict access to the build stage of the OpenStack RabbitMQ container image to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-494

CWE-20

Related Identifiers

CVE-2018-14620

Affected Products

Openstack Rabbitmq

Red Hat Openstack

References · 5

• https://access.redhat.com/errata/RHSA-2018:2729 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2721 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14620 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14620 · Vendor Advisory