Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

openstack-magnum

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8PyPIAmendedPublished

    Openstack Magnum Unsafe Credential Handling

    CVE-2016-7404 · GHSA-793v-r35j-9rp9

    Affected
    • PyPI openstack-magnum < 5.0.0
    Fixed in
    5.0.0· Vendor fix available
    Issue
    OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

    Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →