GHSA-fqw7-c6vr-q29m

Source

https://github.com/advisories/GHSA-fqw7-c6vr-q29m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fqw7-c6vr-q29m/GHSA-fqw7-c6vr-q29m.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fqw7-c6vr-q29m

Aliases

Published

2022-05-13T01:34:06Z

Modified

2024-09-24T21:22:44.353118Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

openstack-mistral Discloses the presence of arbitrary files within the filesystem

Details

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

Database specific

{
    "nvd_published_at": "2018-11-02T21:29:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-29T14:42:50Z"
}

References

Affected packages

PyPI / mistral

Package

Name: mistral; View open source insights on deps.dev
Purl: pkg:pypi/mistral

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.0.1

Affected versions

Other

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.1

0.1.1

1.*

1.0.0.0b1

1.0.0.0b2

1.0.0.0b3

1.0.0.0rc1

1.0.0.0rc2

1.0.0

1.0.1

2.*

2.0.0.0b1

2.0.0.0b2

2.0.0.0b3

2.0.0.0rc1

2.0.0.0rc2

2.0.0.0rc3

2.0.0

3.*

3.0.0.0b1

3.0.2

4.*

4.0.0.0b1

4.0.0.0b2

4.0.0.0b3

4.0.0.0rc1

4.0.0.0rc2

4.0.0

4.0.1

4.0.2

5.*

5.0.0.0b1

5.0.0.0b2

5.0.0.0b3

5.0.0.0rc1

5.0.0

5.1.0

5.2.0

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

6.*

6.0.0.0b1

6.0.0.0b2

6.0.0.0b3

6.0.0.0rc1

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

7.*

7.0.0.0b1

7.0.0.0b2

7.0.0.0b3

7.0.0.0rc1

7.0.0