Skip to content

Openstack Octavia Access Control Vulnerability

Moderate severity GitHub Reviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Feb 23, 2024

Package

pip octavia (pip)

Affected versions

< 0.9.0

Patched versions

0.9.0

Description

Description

An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.

Mitigation

To prevent this vulnerability:

  1. Update Octavia's configuration setting (octavia.conf) to amp_image_owner_id = $UUID_OF_SERVICE_PROJECT on all Octavia nodes.
  2. Enable the new configuration by restarting both octavia_worker and octavia_health_manager.

References

Published by the National Vulnerability Database Jun 3, 2019
Published to the GitHub Advisory Database May 24, 2022
Reviewed Feb 23, 2024
Last updated Feb 23, 2024

Severity

Moderate
5.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weaknesses

CVE ID

CVE-2019-3895

GHSA ID

GHSA-jjgh-m322-fjx6

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.