Aller au contenu
en Se connecter
9.4 Critique

CVE-2026-94572 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field…

Description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
Octavia 18.0 18.0.0 → < 18.0.1 18.0.1
Octavia 17.0 17.0.0 → < 17.0.1 17.0.1
Octavia 6.0 6.0.0 → < 16.1.0 16.1.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Octavia

Les 3 CVE de Octavia →
CVE-2026-94571 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy… 9.4 Critique CVE-2026-74248 OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization 4.3 Moyenne
Suivre cette CVE