Skip to content
Fencer Vulns
medium 5.5

CVE-2019-3895 json

Openstack Octavia Access Control Vulnerability

published 2019-06-03 7 y ago modified 2026-06-17 4 mo ago also GHSA-jjgh-m322-fjx6 , PYSEC-2019-194 , EUVD-2019-0100

cvss
5.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.

Patch / fix

  • pypi octavia 0.9.0
  • openstack octavia 0.9.0
  • openstack-tripleo-common openstack 14 9.5.0-5.el7ost
  • python2-tripleo-common openstack 14 9.5.0-5.el7ost
  • openstack-tripleo-common-devtools openstack 14 9.5.0-5.el7ost
  • openstack-tripleo-common-containers openstack 14 9.5.0-5.el7ost
  • openstack-tripleo-common-container-base openstack 14 9.5.0-5.el7ost
  • openstack-tripleo-common openstack 13 8.6.8-11.el7ost
  • openstack-tripleo-common-devtools openstack 13 8.6.8-11.el7ost
  • openstack-tripleo-common-containers openstack 13 8.6.8-11.el7ost

red hat advisories RHSA-2019:1683RHSA-2019:1742

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-3895 updated cvss 5.5

openstack-tripleo-common: Allows running new amphorae based on arbitrary images

  • Red Hat OpenStack Platform 13.0 openstack-tripleo-common 8.6.8-11.el7ost, openstack-tripleo-common-devtools 8.6.8-11.el7ost, openstack-tripleo-common-containers 8.6.8-11.el7ost, openstack-tripleo-common-container-base 8.6.8-11.el7ost
    fixed: vendor fix RHSA-2019:1742
  • Red Hat OpenStack Platform 14.0 python2-tripleo-common 9.5.0-5.el7ost, openstack-tripleo-common 9.5.0-5.el7ost, openstack-tripleo-common-devtools 9.5.0-5.el7ost, openstack-tripleo-common-containers 9.5.0-5.el7ost, openstack-tripleo-common-container-base 9.5.0-5.el7ost
    fixed: vendor fix RHSA-2019:1683
  • Red Hat OpenStack Platform 15 (Stein) python3-tripleo-common, openstack-tripleo-common, openstack-tripleo-common-devtools, openstack-tripleo-common-containers, openstack-tripleo-common-container-base
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.60% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
NVD 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.0 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
pypi octavia
<0.9.0
0.9.0

Affected products

  • Red Hat openstack-tripleo-common

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.