CVE-2019-17134
First published: Tue Oct 08 2019(Updated: )
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the `cmd/agent.py` gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openstack-octavia | <2.1.2-1.el7 | 2.1.2-1.el7 |
| redhat/openstack-octavia-4.1.0 | <1 | 1 |
| pip/octavia | >=4.0.0<4.1.0 | 4.1.0 |
| pip/octavia | >=3.0.0<3.2.0 | 3.2.0 |
| pip/octavia | >=0.10.0<2.1.2 | 2.1.2 |
| debian/octavia | 7.1.0-2 11.0.0-2 14.0.0-4 | |
| OpenStack Octavia | >=0.10.0<2.1.2 | |
| OpenStack Octavia | >=3.0.0<3.2.0 | |
| OpenStack Octavia | >=4.0.0<4.1.0 | |
| Ubuntu | =19.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2019:3743
- https://access.redhat.com/errata/RHSA-2019:3788
- https://access.redhat.com/errata/RHSA-2020:0721
- https://review.opendev.org/686541
- https://review.opendev.org/686543
- https://review.opendev.org/686544
- https://review.opendev.org/686545
- https://review.opendev.org/686546
- https://review.opendev.org/686547
- https://security.openstack.org/ossa/OSSA-2019-005.html
- https://storyboard.openstack.org/#!/story/2006660
- https://usn.ubuntu.com/4153-1/
- https://storyboard.openstack.org/#%21/story/2006660
- https://launchpad.net/bugs/cve/CVE-2019-17134
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17134
- https://access.redhat.com/security/cve/cve-2019-17134
- https://bugzilla.redhat.com/show_bug.cgi?id=1761307
- https://nvd.nist.gov/vuln/detail/CVE-2019-17134
- https://github.com/openstack/octavia/commit/1725517d1d209f26b2275306d83e49c099dcbe1a
- https://github.com/openstack/octavia/commit/2976a7f0f109e17930db8a61136526ead44ea7e5
- https://github.com/openstack/octavia/commit/624ff08f27bcb73788663cbe6d35cbe29c537844
- https://github.com/openstack/octavia/commit/89a2f6e0136ad49d928eb65b4cf555af2a2b8ab1
- https://github.com/openstack/octavia/commit/b0c2cd7b4c835c391cfedf12cf9f9ff8a0aabd17
- https://github.com/openstack/octavia/commit/c2fdffc3b748f8007c72e52df257e38756923b40
- https://github.com/advisories/GHSA-r4v4-3jj7-jc29 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2019-17134
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17134
- https://ubuntu.com/security/CVE-2019-17134
Frequently Asked Questions
What is the severity of CVE-2019-17134?
CVE-2019-17134 has a high severity due to its potential to allow unauthorized access to sensitive configurations and information.
How do I fix CVE-2019-17134?
To fix CVE-2019-17134, upgrade OpenStack Octavia to version 2.1.2 or later, or to a version above 3.2.0 or 4.1.0.
What software is affected by CVE-2019-17134?
CVE-2019-17134 affects OpenStack Octavia versions between 0.10.0 and 2.1.2, as well as versions from 3.0.0 to 3.2.0, and from 4.0.0 to 4.1.0.
Is there a workaround for CVE-2019-17134?
There is no documented workaround for CVE-2019-17134, and it is strongly recommended to apply updates.
What are the potential consequences of CVE-2019-17134?
The exploitation of CVE-2019-17134 can lead to unauthorized actions performed on the Octavia Agent, compromising the security of the OpenStack deployment.
- agent/type
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-17134
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r4v4-3jj7-jc29
- agent/severity
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/trending
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- package-manager/redhat
- package-manager/pip
- package-manager/debian
- vendor/opendev
- canonical/openstack octavia
- version/openstack octavia/0.10.0
- version/openstack octavia/3.0.0
- version/openstack octavia/4.0.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/19.04