CVE-2021-31918

tripleo-ansible: ansible.log file is visible to unprivileged users

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openstack

CVE-2021-31542

django: Potential directory-traversal via uploaded files

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 3 more

CVE-2021-31525

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

CVSS 3.1 · 5.9 Medium EPSS 3.7% KEV · Not listed

Vendors

Fedoraproject Golang Redhat

Products

Fedora Go Advanced Cluster Security and 8 more

CVE-2021-29923

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed

Vendors

Fedoraproject Golang Oracle and 1 more

Products

Fedora Go Timesten In-memory Database and 10 more

CVE-2021-29482

denial of service in github.com/ulikunitz/xz

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Redhat Xz Project

Products

Acm Container Native Virtualization Openshift Api Data Protection and 3 more

CVE-2021-28658

django: potential directory-traversal via uploaded files

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS 3.8% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 3 more

CVE-2021-27928

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

CVSS 3.1 · 7.2 High EPSS 38.2% KEV · Not listed

Vendors

Debian Galeracluster Mariadb and 2 more

Products

Debian Linux Wsrep Mariadb and 5 more

CVE-2021-27025

puppet: silent configuration failure in agent

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Fedoraproject Puppet Redhat

Products

Fedora Puppet Puppet Agent and 5 more

CVE-2021-21419

Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Eventlet Fedoraproject Redhat

Products

Eventlet Fedora Openshift and 1 more

CVE-2021-21240

Regular Expression Denial of Service in httplib2

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed

Vendors

Httplib2 Project Redhat

Products

Httplib2 Openstack

CVE-2021-20270

python-pygments: Infinite loop in SML lexer may lead to DoS

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Debian Fedoraproject Pygments and 1 more

Products

Debian Linux Fedora Pygments and 6 more

CVE-2021-20267

openstack-neutron: Anti-spoofing bypass using Open vSwitch

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.

CVSS 3.1 · 7.1 High EPSS 1.0% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack Platform

CVE-2021-20257

QEMU: net: e1000: infinite loop while processing transmit descriptors

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Qemu and 1 more

Products

Debian Linux Fedora Qemu and 6 more

CVE-2020-9543

openstack-manila: User with share-network UUID is able to show, create and delete shares

OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed

Vendors

Openstack Redhat

Products

Manila Openstack

CVE-2020-9490

httpd: Push diary crash on specifically crafted HTTP/2 header

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed

Vendors

Apache Canonical Debian and 4 more

Products

Http Server Ubuntu Linux Debian Linux and 25 more

CVE-2020-8608

QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.

CVSS 3.1 · 5.6 Medium EPSS 2.5% KEV · Not listed

Vendors

Debian Libslirp Project Opensuse and 1 more

Products

Debian Linux Libslirp Leap and 8 more

CVE-2020-7039

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

CVSS 3.1 · 5.6 Medium EPSS 3.6% KEV · Not listed

Vendors

Debian Libslirp Project Opensuse and 2 more

Products

Debian Linux Libslirp Leap and 9 more

CVE-2020-29565

python-django-horizon: dashboard allows open redirect

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Openstack Redhat

Products

Debian Linux Horizon Openstack

CVE-2020-27781

ceph: User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ceph Ceph Storage and 3 more

CVE-2020-25743

QEMU: ide: null pointer dereference while cancelling i/o operation

hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Openstack Platform