CVE-2018-16849: Infoleak
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16849?
The severity of CVE-2018-16849 is high.
What is the affected software of CVE-2018-16849?
The affected software of CVE-2018-16849 is Redhat Openstack-mistral version up to exclusive 7.0.1.
How can CVE-2018-16849 be exploited?
CVE-2018-16849 can be exploited by manipulating the SSH private key filename to disclose arbitrary files within the filesystem of the executor running the action.
Are there any references for CVE-2018-16849?
Yes, here are the references for CVE-2018-16849: [1] https://bugs.launchpad.net/mistral/+bug/1783708 [2] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849
What is the CWE of CVE-2018-16849?
The CWE of CVE-2018-16849 is CWE-200.