~ / search / GHSA-fqw7-c6vr-q29m

GHSA-fqw7-c6vr-q29m

openstack-mistral Discloses the presence of arbitrary files within the filesystem

Source: GitHub Advisory Database (reviewed) High CVE-2018-16849

Packages

EcosystemPackageAffectedFixed in
PyPI mistral < 7.0.1 7.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

References

External links from the advisory. They lead to third-party sites.