GitHub Advisoryadvisory · PyPI

GHSA-793v-r35j-9rp9 Openstack Magnum Unsafe Credential Handling

CRITICAL Published 2022-05-24 Modified 2023-07-27 Official page ↗
Aliases
CVE-2016-7404
Ecosystem
PyPI
Packages
openstack-magnum
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2023-07-27

Affected packages

• PyPI openstack-magnum: < 5.0.0 → fixed in 5.0.0

Description

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

Related

Alias · CVE (1)

  • CVE-2016-7404 OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References