CVE-2016-7404

NameCVE-2016-7404
DescriptionOpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs863547

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
magnum (PTS)stretch3.1.1-5fixed
buster7.1.0-1fixed
bullseye, sid8.0.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
magnumsource(unstable)3.1.1-5high863547

Notes

https://git.openstack.org/cgit/openstack/magnum/commit/?id=0bb0d6486d6771ee21bbf897a091b1aa59e01b22

Search for package or bug name: Reporting problems