PT-2018-13771 · Openstack+1 · Openstack-Mistral+1

Published 2018-11-02 · Updated 2025-04-28 · CVE-2018-16849

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-mistral (affected versions not specified)

Description A flaw in openstack-mistral allows the disclosure of the presence of arbitrary files within the filesystem of the executor running the action. This is achieved by manipulating the SSH private key filename in the std.ssh action, which can take an absolute path to assess whether a file exists on the executor's filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-16849

GHSA-FQW7-C6VR-Q29M

PYSEC-2018-92

USN-7465-1

Affected Products

Ubuntu

Openstack-Mistral

References · 23

• https://osv.dev/vulnerability/PYSEC-2018-92 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16849 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16849 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02256 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16849 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16849 · Security Note
• https://ubuntu.com/security/CVE-2018-16848 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3866 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16849 · Security Note
• https://osv.dev/vulnerability/GHSA-fqw7-c6vr-q29m · Vendor Advisory
• https://osv.dev/vulnerability/USN-7465-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3866 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16849 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16849 · Vendor Advisory