CVE-2018-14620: Input Validation
The OpenStack RabbitMQ container image insecurely retrieves the rabbitmqclusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container and openstack-containers as shipped with Red Hat Openstack 12, 13, 14 are believed to be vulnerable.
Other sources
The openstack-rabbitmq-container image insecurely retrieves the rabbitmqclusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14620?
CVE-2018-14620 is considered a high-severity vulnerability due to the potential for attackers to serve malicious code during the build stage.
How do I fix CVE-2018-14620?
To fix CVE-2018-14620, ensure that the OpenStack RabbitMQ container image retrieves components using secure HTTP (HTTPS) instead of HTTP.
Which versions are affected by CVE-2018-14620?
CVE-2018-14620 affects Red Hat OpenStack versions 12 and 13.
What is the impact of CVE-2018-14620?
The impact of CVE-2018-14620 includes the risk of installing harmful software in the resultant container image.
Is CVE-2018-14620 related to container security?
Yes, CVE-2018-14620 specifically highlights a vulnerability in the container image build process affecting security.