Vulnerability Description
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openstack-Mistral | < 7.0.1 |
Related Weaknesses (CWE)
References
- https://bugs.launchpad.net/mistral/+bug/1783708Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849Issue TrackingVendor Advisory
- https://bugs.launchpad.net/mistral/+bug/1783708Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849Issue TrackingVendor Advisory
FAQ
What is CVE-2018-16849?
CVE-2018-16849 is a vulnerability with a CVSS score of 3.1 (LOW). A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor ru...
How severe is CVE-2018-16849?
CVE-2018-16849 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16849?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Openstack-Mistral.