Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3743 advisory.

    The OpenStack Load Balancing service (openstack-octavia) provides a Load Balancing-as-a-Service (LBaaS)     version 2 implementation for Red Hat OpenStack platform director based installations.

    Security Fix(es):

    * openstack-octavia: amphora-agent not requiring client certificate (CVE-2019-17134)

    For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other     related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3788 advisory.

    The OpenStack Load Balancing service (openstack-octavia) provides a Load Balancing-as-a-Service (LBaaS)     version 2 implementation for Red Hat OpenStack platform director based installations.

    Security Fix(es):

    * openstack-octavia: amphora-agent not requiring client certificate (CVE-2019-17134)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [Backport request]Add failover logging to show the amphora details. (BZ#1743476)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0721 advisory.

    The OpenStack Load Balancing service (openstack-octavia) provides a Load     Balancing-as-a-Service (LBaaS) version 2 implementation for Red Hat     OpenStack platform director based installations.

    Security Fix(es):

    * amphora-agent not requiring client certificate (CVE-2019-17134)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Daniel Preussker discovered that Octavia incorrectly handled client certificate checking. A remote attacker on the management network could possibly use this issue to perform configuration changes and obtain sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
194176	RHEL 7 : openstack-octavia (RHSA-2019:3743)	Nessus	Red Hat Local Security Checks	critical
194103	RHEL 7 : openstack-octavia (RHSA-2019:3788)	Nessus	Red Hat Local Security Checks	critical
170293	RHEL 8 : openstack-octavia (RHSA-2020:0721)	Nessus	Red Hat Local Security Checks	critical
129808	Ubuntu 19.04 : Octavia vulnerability (USN-4153-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2019-17134

critical

Tenable Plugins

critical

critical

critical

critical