Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03OTN2LXIzNWotOXJwOc4AAhFF

Openstack Magnum Unsafe Credential Handling

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

Permalink: https://github.com/advisories/GHSA-793v-r35j-9rp9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03OTN2LXIzNWotOXJwOc4AAhFF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 5 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-793v-r35j-9rp9, CVE-2016-7404
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-7404
• https://bugs.launchpad.net/magnum/+bug/1620536
• https://bugzilla.suse.com/show_bug.cgi?id=998182
• https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22
• https://github.com/openstack/magnum/commit/e93d82e8b3bc19211efd54edc17aebdca50670c1
• https://web.archive.org/web/20210124052053/https://www.securityfocus.com/bid/98467
• https://github.com/advisories/GHSA-793v-r35j-9rp9

Repository: https://github.com/openstack/magnum
Blast Radius: 3.0

Affected Packages