CVE-2019-3895 in OpenStack and Red Hat Products
Published on June 3, 2019
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2019-3895 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2019-3895
stack.watch emails you whenever new vulnerabilities are published in OpenStack Octavia or Red Hat Openstack. Just hit a watch button to start following.
Affected Versions
Red Hat openstack-tripleo-common Version n/a is affected by CVE-2019-3895Exploit Probability
EPSS
1.43%
Percentile
71.34%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.