GHSA-rfm2-f94j-qhjp

Source

https://github.com/advisories/GHSA-rfm2-f94j-qhjp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-rfm2-f94j-qhjp/GHSA-rfm2-f94j-qhjp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rfm2-f94j-qhjp

Aliases

CVE-2024-28717

Published

2024-04-22T12:30:33Z

Modified

2024-07-03T20:52:10.373855Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

OpenStack Storlets arbitrary code execution vulnerability

Details

An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2024-04-22T12:15:07Z",
    "cwe_ids": [
        "CWE-367",
        "CWE-400"
    ],
    "github_reviewed_at": "2024-04-22T15:56:33Z",
    "severity": "HIGH"
}

References

Affected packages

PyPI / storlets

Package

Name: storlets; View open source insights on deps.dev
Purl: pkg:pypi/storlets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

13.0.0.0rc1

Affected versions

0.*

0.1

0.3.1.dev55

0.6.0

0.7.0

1.*

1.0.0

2.*

2.0.0.0b1

2.0.0.0b2

2.0.0.0b3

2.0.0.0rc1

2.0.0

3.*

3.0.0.0b1

3.0.0.0rc1

3.0.0.0rc2

3.0.0

4.*

4.0.0.0rc1

4.0.0.0rc2

4.0.0

5.*

5.0.0.0b1

5.0.0.0rc1

5.0.0

6.*

6.0.0.0rc1

6.0.0

7.*

7.0.0.0rc1

7.0.0

8.*

8.0.0.0rc1

8.0.0

9.*

9.0.0.0rc1

9.0.0

10.*

10.0.0.0rc1

10.0.0

11.*

11.0.0.0rc1

11.0.0

12.*

12.0.0.0rc1

12.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-rfm2-f94j-qhjp/GHSA-rfm2-f94j-qhjp.json"