Red Hat Openstack-Mistral vulnerabilities

3 CVEs affecting Red Hat Openstack-Mistral, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-16848, published 2020-06-15.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-16849, published 2018-11-02. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor…
• CVE-2018-16848, published 2020-06-15. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can…
• CVE-2019-3866, published 2019-11-08. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit…