important · Remote code execution
An OpenStack tenant can turn Octavia load-balancer fields into root execution on provider-managed amphorae.
Affects
OpenStack Octavia, the load-balancer service used by private and public clouds; affected deployments use provider-managed Amphora HAProxy appliances.
On Amphora-backed load balancers, control characters in tenant-controlled cipher or redirect fields inject HAProxy directives that execute as root. That reaches other tenants' TLS keys, the heartbeat key and the control-plane network. OpenStack has published a patch.