Openstack Octavia vulnerabilities

CVE-2019-17134 [CRITICAL] CWE-287 OpenStack Octavia Amphora-Agent not requiring Client-Certificate OpenStack Octavia Amphora-Agent not requiring Client-Certificate Amphora Images in OpenStack Octavia >=0.10.0 =3.0.0 =4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the `cmd/agent.py` gunicorn cert_reqs option

CVE-2019-3895 [HIGH] CWE-284 CVE-2019-3895: An access-control flaw was found in the Octavia service when the cloud platform was deployed using R An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compr

CVE-2018-16856 [HIGH] CWE-532 CVE-2018-16856: In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions ope In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.