PyPI: mistral
CVE-2018-16849
Safety vulnerability ID: SFTY-20181102-70909
Safety legacy ID: pyup.io-36611
Mistral 7.0.1 includes a fix for CVE-2018-16849: By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
Overview
openstack-mistral Discloses the presence of arbitrary files within the filesystem
Advisory
Mistral 7.0.1 includes a fix for CVE-2018-16849: By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20181102-70909/CVE-2018-16849
- https://nvd.nist.gov/vuln/detail/CVE-2018-16849
- https://bugs.launchpad.net/mistral/+bug/1783708
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849
- https://github.com/openstack/mistral/commit/c93b45a61f49d4633f76d8e117cd89063e7759c4
- https://github.com/openstack/mistral/commit/2309e5265a1d5f28480ae872817b5de05f66e83c
- https://github.com/pypa/advisory-database/tree/main/vulns/mistral/PYSEC-2018-92.yaml
- https://github.com/advisories/GHSA-fqw7-c6vr-q29m
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more