PT-2019-5610 · Openstack+1 · Openstack Octavia+1

Published 2019-05-27 · Updated 2022-05-24 · CVE-2019-3895

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Octavia (affected versions not specified)

Description An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. This flaw allows a remote attacker to upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations To prevent this vulnerability:

1. Update Octavia's configuration setting (octavia.conf) to amp image owner id = $UUID OF SERVICE PROJECT on all Octavia nodes.
2. Enable the new configuration by restarting both octavia worker and octavia health manager.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-04695

CVE-2019-3895

GHSA-JJGH-M322-FJX6

PYSEC-2019-194

RHSA-2019:1683

RHSA-2019:1742

Affected Products

Openstack Octavia

Red Hat Openstack Platform Director

References · 21

• https://access.redhat.com/errata/RHSA-2019:1742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3895 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1683 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3895 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-194 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3895 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04695 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3895 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jjgh-m322-fjx6 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3895 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octavia/PYSEC-2019-194.yaml · Note
• https://github.com/openstack/octavia/commit/d7d062a47ab54a540d81f13a0e5f3085ebfaa0d2 · Note
• https://github.com/openstack/octavia · Note
• https://github.com/openstack/octavia/blob/08570831754d9671fbd1756d668f55f191e47ca4/octavia/compute/drivers/nova_driver.py#L35 · Note
• https://github.com/openstack/tripleo-common/commit/e7c5eab712e0f70ecbc6d225d4766e0fe0f3f884 · Note