Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Openstack
(Redhat)Repositories |
• https://github.com/openvswitch/ovs
• https://github.com/openstack/heat-templates • https://github.com/memcached/memcached • https://github.com/antirez/redis • https://github.com/apache/httpd |
#Vulnerabilities | 210 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2019-11-01 | CVE-2013-2255 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. | Debian_linux, Compute, Keystone, Openstack | N/A | ||
2018-02-19 | CVE-2017-18191 | An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected. | Nova, Openstack | 7.5 | ||
2015-01-23 | CVE-2014-9623 | OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state. | Image_registry_and_delivery_service_\(Glance\), Openstack | N/A | ||
2015-01-07 | CVE-2014-9493 | The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property. | Image_registry_and_delivery_service_\(Glance\), Openstack | N/A | ||
2014-10-31 | CVE-2014-8333 | The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state. | Nova, Openstack | N/A | ||
2014-10-08 | CVE-2014-7231 | The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log. | Cinder, Nova, Trove, Openstack | N/A | ||
2014-10-08 | CVE-2014-7230 | The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log. | Ubuntu_linux, Cinder, Nova, Trove, Openstack | N/A | ||
2017-03-31 | CVE-2014-5009 | Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008. | Nagios, Openstack, Snoopy | 9.8 | ||
2017-03-31 | CVE-2014-5008 | Snoopy allows remote attackers to execute arbitrary commands. | Debian_linux, Openstack, Snoopy | 9.8 | ||
2014-08-19 | CVE-2014-4615 | The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request). | Ubuntu_linux, Neutron, Oslo, Pycadf, Telemetry_\(Ceilometer\), Openstack | N/A |