CVE-2018-14620: red hat openstack-rabbitmq-container Download of Code Without Integrity Check
Vulnerability summary
CVE-2018-14620 is a critical (CVSS 9.8) Download of Code Without Integrity Check vulnerability in red hat openstack-rabbitmq-container. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.4% of scored vulnerabilities.
Timeline
- 10-09-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container and openstack-containers as shipped with Red Hat Openstack 12, 13, 14 are believed to be vulnerable.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA4.7MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Red hat1 product
- openstack-rabbitmq-container12, 13, 14
Redhat1 product
- openstack12 | 13
2 vendors · 2 products