CVE-2019-17134 PUBLISHED CVSS 6.400000095367432 MEDIUM

Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.

EPSS 0.39% · 59.8th percentile

Risk Scores

CVSS v2.0
6.400000095367432
EPSS Score
0.39%
59.8th percentile

Affected Products

VendorProductVersions
canonicalubuntu_linux19.04
n/an/an/a
PyPIoctavia3.0.0, 4.0.0, 0.10.0
opendevoctavia0.10.0, 3.0.0, 4.0.0

Timeline

References

…and 1 more

Open in Interactive Console →