CVE-2016-7404

Опубликовано: 21 июн. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

Ссылки

https://bugs.launchpad.net/magnum/+bug/1620536
Broken Link
Issue Tracking
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=998182
Issue Tracking
Patch
Third Party Advisory
https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22
Patch
Third Party Advisory
https://www.securityfocus.com/bid/98467
Third Party Advisory
VDB Entry
https://bugs.launchpad.net/magnum/+bug/1620536
Broken Link
Issue Tracking
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=998182
Issue Tracking
Patch
Third Party Advisory
https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22
Patch
Third Party Advisory
https://www.securityfocus.com/bid/98467
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openstack:magnum:-:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.02859

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2016-7404

CVSS3: 9.8

ubuntu

больше 6 лет назад

CVE-2016-7404

CVSS3: 9.8

debian

больше 6 лет назад

OpenStack Magnum passes OpenStack credentials into the Heat templates ...

GHSA-793v-r35j-9rp9

CVSS3: 9.8

github

больше 3 лет назад

Openstack Magnum Unsafe Credential Handling

EPSS

Процентиль: 86%

0.02859

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-200