CVE-2018-14620CWE-494

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage

Medium · published September 10, 2018

CVSS v3.0
4.7
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container and openstack-containers as shipped with Red Hat Openstack 12, 13, 14 are believed to be vulnerable.

The record
Technical detail
CVSS v3.0
4.7 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00597 · 47.8th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2018-09-10T19:00Z
EPSS history
Timeline
  • 10 SEP 19:00Z
    The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage
    cvelistv5