CVE-2018-16849

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.


CONFIRM:https://bugs.launchpad.net/mistral/+bug/1783708: https://bugs.launchpad.net/mistral/+bug/1783708
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16849
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849
• https://bugs.launchpad.net/mistral/+bug/1783708