CVE-2019-3895

Name	CVE-2019-3895
Description	An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
octavia (PTS)	buster	3.0.0-3+deb10u1	fixed
	bullseye	7.1.0-2	fixed
	bookworm	11.0.0-2	fixed
	sid	14.0.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
octavia	source	(unstable)	(not affected)

Notes

- octavia <not-affected> (Fixed before initial upload to the archive)
https://bugs.launchpad.net/octavia/+bug/1620629
https://bugzilla.redhat.com/show_bug.cgi?id=1694608