An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitra
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | octavia | < 0.9.0 | 0.9.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-3895
- https://github.com/openstack/octavia/commit/d7d062a47ab54a540d81f13a0e5f3085ebfaa0d2
- https://github.com/openstack/tripleo-common/commit/e7c5eab712e0f70ecbc6d225d4766e0fe0f3f884
- https://access.redhat.com/errata/RHSA-2019:1683
- https://access.redhat.com/errata/RHSA-2019:1742
- https://bugs.launchpad.net/octavia/+bug/1620629
- https://bugs.launchpad.net/tripleo/+bug/1830607
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895
- https://github.com/openstack/octavia
- https://github.com/openstack/octavia/blob/08570831754d9671fbd1756d668f55f191e47ca4/octavia/compute/drivers/nova_driver.py#L35
- https://github.com/pypa/advisory-database/tree/main/vulns/octavia/PYSEC-2019-194.yaml
- https://opendev.org/openstack/octavia/commit/d7d062a47ab54a540d81f13a0e5f3085ebfaa0d2
- https://github.com/advisories/GHSA-jjgh-m322-fjx6
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-284- Platform
- Python (PyPI)
- Package
octavia- Disclosed
- 03.06.2019
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jjgh-m322-fjx6 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2019-194 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: octavia
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 03.2019 05.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 1
Disclosures per year
- 2019: 2
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitra this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.