CVE-2017-8190 Security feature bypass in FusionSphere OpenStack
An attacker with high privileges can bypass cryptographic signature verification to inject malicious software into Huawei FusionSphere OpenStack.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8190?
CVE-2017-8190 is a medium-severity vulnerability in Huawei Technologies Co., Ltd. FusionSphere OpenStack, published on 22 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic signature vulnerability. The software does not verify the cryptographic signature. An attacker with high privilege may exploit this vulnerability to inject malicious software.
Weakness: CWE-347
Which versions are affected by CVE-2017-8190?
It affects 1 product.
Products include Huawei Fusionsphere Openstack.
How do I fix CVE-2017-8190?
No fix has been published for CVE-2017-8190 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8190 being exploited?
There is no known exploitation of CVE-2017-8190 in the wild and no public exploit code.
Other vulnerabilities in Huawei Technologies Co., Ltd. FusionSphere OpenStack
Sources
Also known as GHSA-wgjg-8jrw-h95f.