CVE-2016-7404

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.launchpad.net/magnum/+bug/1620536Broken Link, Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=998182Issue Tracking, Patch, Third Party Advisory
https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22Patch, Third Party Advisory
https://www.securityfocus.com/bid/98467Third Party Advisory, VDB Entry
https://bugs.launchpad.net/magnum/+bug/1620536Broken Link, Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=998182Issue Tracking, Patch, Third Party Advisory
https://opendev.org/openstack/magnum/commit/0bb0d6486d6771ee21bbf897a091b1aa59e01b22Patch, Third Party Advisory
https://www.securityfocus.com/bid/98467Third Party Advisory, VDB Entry

Timeline

Published: Jun 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-74059.8The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injectio CVE-2016-74069.8Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in CVE-2016-74079.8The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.CVE-2016-74088.8The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.CVE-2016-74095.5The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v CVE-2016-74105.5The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) vi CVE-2016-74119.8ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a d CVE-2016-74128.1ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, w CVE-2016-74139.8Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote CVE-2016-74149.8The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is la CVE-2016-74159.8Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ all CVE-2016-74167.5ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to th