VULNERABILITY INTELLIGENCE

CVE-2019-3895

CVSS score8 HIGH

EPSS probability1.61%

CISA KEVNot currently listed

Published2019-06-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Description

An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.

Weakness classification

secalert@redhat.com: CWE-284
nvd@nist.gov: NVD-CWE-Other

Primary references

secalert@redhat.com — Third Party Advisory
secalert@redhat.com — Third Party Advisory
secalert@redhat.com — Issue Tracking, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mitigation, Third Party Advisory