Security Advisory - Two Command Injection Vulnerabilities in The FusionSphere OpenStack

The FusionSphere has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. (Vulnerability ID: HWPSIRT-2017-05142 and HWPSIRT-2017-05143)

The two vulnerabilities have been assigned two Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-2718 and CVE-2017-2719.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

<http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170823-01-openstack-en&gt;