PT-2024-22538 · Openstack · Openstack Magnum

Lujie + 1 · Published 2024-04-12 · Updated 2024-08-15 · CVE-2024-28718

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack magnum yoga-eom version (affected versions not specified)

Description An issue in the software allows a remote attacker to execute arbitrary code via the cert manager.py component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-28718

GHSA-JX7X-9R98-H5XR

Affected Products

Openstack Magnum

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2024-28718 · Security Note
• https://ubuntu.com/security/CVE-2024-28718 · Vendor Advisory
• https://review.opendev.org/c/openstack/magnum/+/907305 · Patch
• https://osv.dev/vulnerability/GHSA-jx7x-9r98-h5xr · Vendor Advisory
• https://bugs.launchpad.net/magnum/+bug/2047690 · Patch
• https://cve.org/CVERecord?id=CVE-2024-28718 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28718 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28718 · Vendor Advisory
• https://github.com/openstack/magnum/commit/e79907c521149872c1b495355a3a7b3a0c7e3479 · Note
• https://github.com/openstack/magnum/commit/312aa6a86ac8e62f6ed4f1e9473fdabbbb7a4b1e · Note
• https://github.com/openstack/magnum/commit/883b40b5b0ecfc5f78758143c0d3c754458f12b7 · Note
• https://github.com/openstack/magnum · Note
• https://github.com/openstack/magnum/commit/272fd686d8c8bf5954e9e7d3bc991ff27e46184d · Note
• https://gist.github.com/Fewword/f098d8d6375ac25e27b18c0e57be532f · Note
• https://t.me/cvenotify/76801 · Telegram Post