Skip to content
Fencer Intel
low 3.1

CVE-2018-16849 json

openstack-mistral Discloses the presence of arbitrary files within the filesystem

published 8y ago modified 4mo ago also GHSA-fqw7-c6vr-q29m , PYSEC-2018-92 , EUVD-2018-0099

cvss
3.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

Patch / fix

  • pypi mistral 7.0.1
  • redhat openstack-mistral 7.0.1
  • mistral Debian 14, Debian 13, Debian 12 7.0.0-2

debian advisories DEBIAN-CVE-2018-16849

  • mistral Ubuntu Pro 16.04 LTS 2.0.0-1ubuntu2+esm1
  • mistral Ubuntu Pro 18.04 LTS 6.0.0-0ubuntu1.1+esm1

ubuntu advisories UBUNTU-CVE-2018-16849

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • puppet-ovn openstack 13 12.4.0-2.el7ost
  • puppet-nova openstack 13 12.4.0-16.el7ost
  • puppet-swift openstack 13 12.4.0-4.el7ost
  • os-net-config openstack 13 8.4.3-6.el7ost
  • puppet-cinder openstack 13 12.4.1-3.el7ost
  • puppet-manila openstack 13 12.5.0-3.el7ost
  • puppet-neutron openstack 13 12.4.1-4.ed05e01git.el7ost
  • puppet-octavia openstack 13 12.4.0-8.el7ost

red hat advisories RHBA-2019:0448

Is CVE-2018-16849 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16849 updated cvss 4.3

openstack-mistral: std.ssh action may disclose presence of arbitrary files

  • Red Hat OpenStack Platform 14 (Rocky) python-mistral, python-mistral-tests, openstack-mistral-all, openstack-mistral-api, openstack-mistral-common, openstack-mistral-engine, +2 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 15 (Stein) python3-mistral, openstack-mistral-all, openstack-mistral-api, openstack-mistral-common, openstack-mistral-engine, openstack-mistral-executor, +2 more
    affected: no fix available
  • Red Hat OpenStack Platform 13.0 puppet-ovn 12.4.0-2.el7ost, os-net-config 8.4.3-6.el7ost, puppet-nova 12.4.0-16.el7ost, puppet-swift 12.4.0-4.el7ost, puppet-cinder 12.4.1-3.el7ost, puppet-manila 12.5.0-3.el7ost, +29 more
    fixed: vendor fix RHBA-2019:0448

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.52% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi mistral
<7.0.1
7.0.1

Affected products

  • [UNKNOWN] openstack-mistral

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.