p PatchFirst

CVE-2018-16849

CVE-2018-16849

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

CVSS 3.1 · Low · EPSS 1.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • openstack-mistral

    Versions
    • n/a: Affected

    No fix published

  • mistral Debian:12

    Affected ranges
    • ECOSYSTEM: < 7.0.0-2

    Update to 7.0.0-2

  • mistral Debian:13

    Affected ranges
    • ECOSYSTEM: < 7.0.0-2

    Update to 7.0.0-2

  • mistral Debian:14

    Affected ranges
    • ECOSYSTEM: < 7.0.0-2

    Update to 7.0.0-2

  • mistral PyPI

    Versions
    • 0
    • 0.0.1
    • 0.0.2
    • 0.0.3
    • 0.0.4
    • 0.1
    • 0.1.1
    • 1.0.0
    • 1.0.0.0b1
    • 1.0.0.0b2
    • 1.0.0.0b3
    • 1.0.0.0rc1
    • 1.0.0.0rc2
    • 1.0.1
    • 2.0.0
    • 2.0.0.0b1
    • 2.0.0.0b2
    • 2.0.0.0b3
    • 2.0.0.0rc1
    • 2.0.0.0rc2
    • 2.0.0.0rc3
    • 3.0.0.0b1
    • 3.0.2
    • 4.0.0
    • 4.0.0.0b1
    • 4.0.0.0b2
    • 4.0.0.0b3
    • 4.0.0.0rc1
    • 4.0.0.0rc2
    • 4.0.1
    • 4.0.2
    • 5.0.0
    • 5.0.0.0b1
    • 5.0.0.0b2
    • 5.0.0.0b3
    • 5.0.0.0rc1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.2.4
    • 5.2.5
    • 5.2.6
    • 5.2.7
    • 5.2.8
    • 6.0.0
    • 6.0.0.0b1
    • 6.0.0.0b2
    • 6.0.0.0b3
    • 6.0.0.0rc1
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 7.0.0
    • 7.0.0.0b1
    • 7.0.0.0b2
    • 7.0.0.0b3
    • 7.0.0.0rc1
    Affected ranges
    • ECOSYSTEM: < 7.0.1

    Update to 7.0.1

  • mistral Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.0-1
    • 1.0.0-4
    • 2.0.0~b3-3
    • 2.0.0~rc1-1
    • 2.0.0~rc2-1
    • 2.0.0-1
    • 2.0.0-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.0.0-1ubuntu2+esm1

    Update to 2.0.0-1ubuntu2+esm1

  • mistral Ubuntu:Pro:18.04:LTS

    Versions
    • 5.0.0-0ubuntu1
    • 6.0.0~b1-0ubuntu1
    • 6.0.0~b1-0ubuntu2
    • 6.0.0~b2-0ubuntu1
    • 6.0.0~rc1-0ubuntu1
    • 6.0.0-0ubuntu1
    • 6.0.0-0ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 6.0.0-0ubuntu1.1+esm1

    Update to 6.0.0-0ubuntu1.1+esm1

Original sources

Check your server →