CVE-2018-14620
low-risk
Published 2018-09-10
The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container and openstack-containers as shipped with Red Hat Openstack 12, 13, 14 are believed to be vulnerable.
Do I need to act?
-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.7/10
Medium
NETWORK
/ HIGH complexity
Affected Vendors
References (6)
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2721
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2729
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14620
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2721
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2729
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14620
23
/ 100
low-risk
Severity
15/34 · Moderate
Exploitability
1/34 · Minimal
Exposure
7/34 · Low