CVE-2016-7404 Openstack Magnum Unsafe Credential Handling
CriticalCVSS 9.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi openstack-magnum(PyPI) | < 5.0.0 | 5.0.0 |
| pypi openstack-magnum(PyPI) | = 2.0.0 | No fix listed |
| debian/magnum(Debian:12) | < 3.1.1-5 | 3.1.1-5 |
| debian/magnum(Debian:13) | < 3.1.1-5 | 3.1.1-5 |
| debian/magnum(Debian:14) | < 3.1.1-5 | 3.1.1-5 |
| OpenStack magnum | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.launchpad.net broken-link issue-tracking third-party-advisory
- bugzilla.suse.com issue-tracking patch third-party-advisory
- github.com product
- opendev.org patch third-party-advisory
- web.archive.org
- github.com vendor-advisory
- pypi.org product
- Debian Security Tracker CVE-2016-7404 vendor-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- bugs.debian.org issue-tracking