Skip to content
OpenAdvisories
Critical RHSA-2019:3788 1 CVE

Red Hat Security Advisory: openstack-octavia security and bug fix update

Published Sep 13, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-amphora-agent 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-api 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-common 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-debuginfo 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-diskimage-create 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-health-manager 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-housekeeping 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-octavia-worker 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 python-octavia 0:2.1.2-1.el7ost
Red Hat · OpenStack 13 openstack:13::el7 python-octavia-tests-golang 0:2.1.2-1.el7ost

Vulnerabilities 1

  • Critical 9.1
    CVE-2019-17134

    OpenStack Octavia Amphora-Agent not requiring Client-Certificate

    Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP …

    octavia octavia Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1712448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1760178
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1761307
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3788.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-17134
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-17134
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-17134
  • article
    https://security.openstack.org/ossa/OSSA-2019-005.html