GitHub Advisoryadvisory · PyPI

GHSA-jx7x-9r98-h5xr OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

MEDIUM Published 2024-04-12 Modified 2024-04-12 Official page ↗
Aliases
CVE-2024-28718
Ecosystem
PyPI
Packages
magnum
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-367
Reviewed
2024-04-12

Affected packages

• PyPI magnum: < 14.1.2 → fixed in 14.1.2 • PyPI magnum: >= 17.0.0.0rc1, < 17.0.2 → fixed in 17.0.2 • PyPI magnum: >= 16.0.0.0rc1, < 16.0.2 → fixed in 16.0.2 • PyPI magnum: >= 15.0.0.0rc1, < 15.0.2 → fixed in 15.0.2

Description

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component.

Related

Alias · CVE (1)

  • CVE-2024-28718 An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References