CVE-2020-26943: Code Injection
First published: Fri Oct 16 2020(Updated: )
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack blazar-dashboard | <1.3.1 | |
| OpenStack blazar-dashboard | =2.0.0 | |
| OpenStack blazar-dashboard | =3.0.0 | |
| pip/blazar-dashboard | =3.0.0 | 3.0.1 |
| pip/blazar-dashboard | =2.0.0 | 2.0.1 |
| pip/blazar-dashboard | <1.3.1 | 1.3.1 |
| <1.3.1 | ||
| =2.0.0 | ||
| =3.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/10/16/5
- https://launchpad.net/bugs/1895688
- https://review.opendev.org/755810
- https://review.opendev.org/755812
- https://review.opendev.org/755813
- https://review.opendev.org/755814
- https://review.opendev.org/756064
- https://security.openstack.org/ossa/OSSA-2020-007.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-26943
- https://github.com/pypa/advisory-database/tree/main/vulns/blazar-dashboard/PYSEC-2020-225.yaml
- https://github.com/advisories/GHSA-939m-4xpw-v34v (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2020-26943.
What is the severity level of CVE-2020-26943?
The severity level of CVE-2020-26943 is critical with a score of 9.9.
What is affected by CVE-2020-26943?
OpenStack blazar-dashboard versions before 1.3.1, 2.0.0, and 3.0.0 are affected by CVE-2020-26943.
How can an attacker exploit CVE-2020-26943?
An attacker with access to the Blazar dashboard in Horizon can trigger code execution on the Horizon host.
Is there a fix available for CVE-2020-26943?
Yes, the fix for CVE-2020-26943 is available in OpenStack blazar-dashboard 1.3.1, 2.0.0, and 3.0.0.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-939m-4xpw-v34v
- alias/CVE-2020-26943
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- vendor/openstack
- canonical/openstack blazar-dashboard
- version/openstack blazar-dashboard/2.0.0
- version/openstack blazar-dashboard/3.0.0
- package-manager/pip