PYSEC-2018-92
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/mistral/PYSEC-2018-92.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2018-92
- Aliases
- Published
- 2018-11-02T21:29:00Z
- Modified
- 2024-04-29T14:56:54.654758Z
- Summary
- [none]
- Details
-
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.
- References
Affected packages
PyPI / mistral
Package
- Name
- mistral
- View open source insights on deps.dev
- Purl
- pkg:pypi/mistral
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed7.0.1
Affected versions
Other
0
0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.1
0.1.1
1.*
1.0.0.0b1
1.0.0.0b2
1.0.0.0b3
1.0.0.0rc1
1.0.0.0rc2
1.0.0
1.0.1
2.*
2.0.0.0b1
2.0.0.0b2
2.0.0.0b3
2.0.0.0rc1
2.0.0.0rc2
2.0.0.0rc3
2.0.0
3.*
3.0.0.0b1
3.0.2
4.*
4.0.0.0b1
4.0.0.0b2
4.0.0.0b3
4.0.0.0rc1
4.0.0.0rc2
4.0.0
4.0.1
4.0.2
5.*
5.0.0.0b1
5.0.0.0b2
5.0.0.0b3
5.0.0.0rc1
5.0.0
5.1.0
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
6.*
6.0.0.0b1
6.0.0.0b2
6.0.0.0b3
6.0.0.0rc1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
7.*
7.0.0.0b1
7.0.0.0b2
7.0.0.0b3
7.0.0.0rc1
7.0.0