CVE-2019-3895
Openstack Octavia Access Control Vulnerability
5.5
MEDIUM
CVSS 3.1
EPSS 1.4%
描述
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
如何修補 CVE-2019-3895
要修補 CVE-2019-3895,請將受影響套件升級到下列已修補版本。
- —升級至 0.9.0 或更新版本
- —升級至 0.9.0 或更新版本
CVE-2019-3895 正在被利用嗎?
低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 0.9.0
- from 0, < 0.9.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |