GitHub Advisoryadvisory · PyPI

GHSA-fqw7-c6vr-q29m openstack-mistral Discloses the presence of arbitrary files within the filesystem

HIGH Published 2022-05-13 Modified 2024-09-24 Official page ↗
Aliases
CVE-2018-16849
Ecosystem
PyPI
Packages
mistral
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-29

Affected packages

• PyPI mistral: < 7.0.1 → fixed in 7.0.1

Description

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References