High severity · published Jun 3, 2019
CVE-2019-3895
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director
8.0
CVSS
1.6%
EPSS
No
On KEV
Description
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Octavia · Openstack
before 0.9.0 · source: NVD
OP
Openstack · Redhat
12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3895
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1683
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1742
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895
More from Octavia
9.4
CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters
9.4
CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields
7.5
CVE-2018-16856
In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log…
4.3
CVE-2026-74248
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization