Openstack Platform (Redhat) - vulnerabilities (CVEs)

39 CVEs, 0 in the last 30 days, 11 known versions, newest CVE from 2024-11-07. Vendor: Redhat.

CVEs of Openstack Platform

CVE-2023-1932 - CVSS 6.1 (medium), 2024-11-07: A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can…
CVE-2024-8007 - CVSS 8.1 (high), 2024-08-21: A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy…
CVE-2024-7319 - CVSS 5 (medium), 2024-08-02: An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command…
CVE-2023-6725 - CVSS 5.5 (medium), 2024-03-15: An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly…
CVE-2023-48795 - CVSS 5.9 (medium), 2023-12-18: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks…
CVE-2023-5625 - CVSS 7.5 (high), 2023-11-01: A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-1636 - CVSS 6 (medium), 2023-09-24: A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration.…
CVE-2023-1633 - CVSS 6.6 (medium), 2023-09-24: A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to…
CVE-2023-1625 - CVSS 7.4 (high), 2023-09-24: An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal…
CVE-2022-3596 - CVSS 7.5 (high), 2023-09-20: An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP…
CVE-2022-3261 - CVSS 7.5 (high), 2023-09-15: A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a…
CVE-2023-1108 - CVSS 7.5 (high), 2023-09-14: A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the…
CVE-2023-3637 - CVSS 6.5 (medium), 2023-07-25: An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for…
CVE-2023-3354 - CVSS 7.5 (high), 2023-07-11: A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a…
CVE-2023-1668 - CVSS 8.2 (high), 2023-04-10: A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP…
CVE-2022-3277 - CVSS 6.5 (medium), 2023-03-06: An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for…
CVE-2022-3100 - CVSS 5.9 (medium), 2023-01-18: A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
CVE-2022-23451 - CVSS 8.1 (high), 2022-09-06: An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or…
CVE-2022-2447 - CVSS 6.6 (medium), 2022-09-01: A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from…
CVE-2022-23452 - CVSS 4.9 (medium), 2022-09-01: An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an…
CVE-2022-2132 - CVSS 8.6 (high), 2022-08-31: A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted…
CVE-2022-0718 - CVSS 4.9 (medium), 2022-08-29: A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any…
CVE-2021-3563 - CVSS 7.4 (high), 2022-08-26: A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity…
CVE-2021-3979 - CVSS 6.5 (medium), 2022-08-25: A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to…
CVE-2020-14394 - CVSS 3.2 (low), 2022-08-17: An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw…
CVE-2022-0866 - CVSS 5.3 (medium), 2022-05-10: This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs…
CVE-2021-20257 - CVSS 6.5 (medium), 2022-03-16: An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if…
CVE-2021-3654 - CVSS 6.1 (medium), 2022-03-02: A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
CVE-2020-1690 - CVSS 6.5 (medium), 2021-06-07: An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege…
CVE-2019-12067 - CVSS 6.5 (medium), 2021-06-02: The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is…
CVE-2021-20267 - CVSS 7.1 (high), 2021-05-28: A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance…
CVE-2021-20270 - CVSS 7.5 (high), 2021-03-23: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source…
CVE-2020-27781 - CVSS 7.1 (high), 2020-12-18: User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack…
CVE-2020-25658 - CVSS 7.5 (high), 2020-11-12: It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the…
CVE-2020-25743 - CVSS 3.2 (low), 2020-10-06: hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
CVE-2020-14365 - CVSS 7.1 (high), 2020-09-23: A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf…
CVE-2020-10731 - CVSS 9.9 (critical), 2020-07-31: A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt,…
CVE-2017-15114 - CVSS 8.1 (high), 2017-11-27: When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all…