Vulnerability in Openstack Octavia
CVE-2019-3895
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
EPSS: 0.014 (70.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Openstack Octavia
- Red Hat Openstack-tripleo-common — versions n/a
- Redhat Openstack — versions 12
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation, Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-3895?
- CVE-2019-3895 is a high-severity vulnerability in Openstack Octavia, classified under Improper Access Control. CVSS score: 8.0/10. Published 2019-06-03.
- How severe is CVE-2019-3895?
- High severity. CVSS v3 base score is 8.0 out of 10.