~ / search / GHSA-r4v4-3jj7-jc29

GHSA-r4v4-3jj7-jc29

OpenStack Octavia Amphora-Agent not requiring Client-Certificate

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-17134

Packages

EcosystemPackageAffectedFixed in
PyPI octavia >= 0.10.0, < 2.1.2 2.1.2
PyPI octavia >= 3.0.0, < 3.2.0 3.2.0
PyPI octavia >= 4.0.0, < 4.1.0 4.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the `cmd/agent.py` gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.

References

External links from the advisory. They lead to third-party sites.