CVE-2018-14620
Last modified
CVE-2018-14620 is a medium-severity vulnerability rated 4.7/10 on the CVSS scale. The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container and openstack-containers as shipped with Red Hat Openstack 12, 13, 14 are believed to be vulnerable.
Metrics
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openstack | 12 |
| Redhat | Openstack | 13 |
References
- https://access.redhat.com/errata/RHSA-2018:2721Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2729Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14620Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2721Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2729Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14620Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-14620?
How severe is CVE-2018-14620?
How do I fix CVE-2018-14620?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-14615An issue was discovered in the Linux kernel through 4.17.10.…
- CVE-2018-14616An issue was discovered in the Linux kernel through 4.17.10.…
- CVE-2018-14617An issue was discovered in the Linux kernel through 4.17.10.…
- CVE-2018-14618curl before version 7.61.1 is vulnerable to a buffer overrun…7.5
- CVE-2018-14619A flaw was found in the crypto subsystem of the Linux kernel…7.8
- CVE-2018-1462IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtua…7.6
- CVE-2018-14621An infinite loop vulnerability was found in libtirpc before …5.3
- CVE-2018-14622A null-pointer dereference vulnerability was found in libtir…7.5
- CVE-2018-14623A SQL injection flaw was found in katello's errata-related A…4.3
- CVE-2018-14624A vulnerability was discovered in 389-ds-base through versio…7.5
- CVE-2018-14625A flaw was found in the Linux Kernel where an attacker may b…5.3
- CVE-2018-14626PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive an…5.3
Are you affected by CVE-2018-14620?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST