PyPI/aodh CVE-2017-12440: high 7.5, EPSS 2.15%
Openstack Aodh can be used to launder Keystone trusts
Action: Upgrade aodh to 6.0.1 or later.
pip install aodh==6.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.0.1 | - |
Fixed versions
| 6.0.1 |
Sources
- osv: GHSA-86cv-9gpx-6hwj
- https://nvd.nist.gov/vuln/detail/CVE-2017-12440
- https://github.com/openstack/aodh/commit/149d3ad2193b4d17df801f82a0a6be62dba564db
- https://github.com/openstack/aodh/commit/92182de328d1f088c5f5a68326d2b207b21e06ea
- https://access.redhat.com/errata/RHSA-2017:3227
- https://access.redhat.com/errata/RHSA-2018:0315
- https://bugs.launchpad.net/ossn/+bug/1649333
- https://review.openstack.org/#/c/493823
- https://review.openstack.org/#/c/493824
- https://review.openstack.org/#/c/493826
- http://www.debian.org/security/2017/dsa-3953
- http://www.securityfocus.com/bid/100455
CVE-2017-12440 · published · modified · JSON