CVE-2016-7404: Infoleak
First published: Fri Jun 21 2019(Updated: )
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/openstack-magnum | <5.0.0 | 5.0.0 |
| OpenStack Magnum Orchestration |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2016-7404
- https://bugs.launchpad.net/magnum/+bug/1620536
- https://bugzilla.suse.com/show_bug.cgi?id=998182
- https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22
- https://github.com/openstack/magnum/commit/e93d82e8b3bc19211efd54edc17aebdca50670c1
- https://web.archive.org/web/20210124052053/https://www.securityfocus.com/bid/98467
- https://github.com/advisories/GHSA-793v-r35j-9rp9 (Advisory)
- https://www.securityfocus.com/bid/98467
Frequently Asked Questions
What is CVE-2016-7404?
CVE-2016-7404 is a vulnerability in OpenStack Magnum that allows unauthorized users to perform any API operation.
How does CVE-2016-7404 work?
CVE-2016-7404 occurs when OpenStack Magnum passes OpenStack credentials into the Heat templates, providing full API access to unauthorized users.
What is the severity of CVE-2016-7404?
CVE-2016-7404 has a severity score of 9.8, indicating a critical vulnerability.
How can I fix CVE-2016-7404?
To fix CVE-2016-7404, it is recommended to upgrade OpenStack Magnum to version 5.0.0 or higher.
Where can I find more information about CVE-2016-7404?
You can find more information about CVE-2016-7404 at the following references: [Reference 1](https://nvd.nist.gov/vuln/detail/CVE-2016-7404), [Reference 2](https://bugs.launchpad.net/magnum/+bug/1620536), [Reference 3](https://bugzilla.suse.com/show_bug.cgi?id=998182).
- collector/github-advisory-latest
- alias/GHSA-793v-r35j-9rp9
- alias/CVE-2016-7404
- collector/github-advisory
- agent/remedy
- agent/type
- agent/author
- agent/softwarecombine
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/pip
- vendor/openstack
- canonical/openstack magnum orchestration