CVE-2018-14620

Impact:
Moderate
Public Date:
2018-09-10
CWE:
CWE-494
Bugzilla:
1626953: CVE-2018-14620 openstack-rabbitmq-container: Insecure download of rabbitmq_clusterer during docker build
The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP, without validation, during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image.

Find out more about CVE-2018-14620 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 4.7
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Impact Low
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat OpenStack Platform 13.0 (Queens) RHSA-2018:2721 2018-09-18
Red Hat OpenStack Platform 12.0 RHSA-2018:2729 2018-09-20

Affected Packages State

Platform Package State
Red Hat OpenStack Platform 14.0 (Rocky) openstack-rabbitmq-container Not affected
Red Hat OpenStack Platform 12.0 openstack-containers Affected
Last Modified