Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2020-15113

Improper Preservation of Permissions in etcd

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Etcd Fedoraproject Redhat
Products
Etcd Fedora Openshift and 1 more
CVE-2020-15112

Improper Input Validation in etcd

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Etcd Fedoraproject Redhat
Products
Etcd Fedora Openshift and 2 more
CVE-2020-15106

Improper Input Validation in etcd

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Etcd Fedoraproject Redhat
Products
Etcd Fedora Openshift and 2 more
CVE-2020-14394

QEMU: infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c

An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Extra Packages For Enterprise Linux Fedora Qemu and 2 more
CVE-2020-14365

ansible: dnf module install packages with no GPG signature

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 2 more
CVE-2020-14364

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

CVSS 3.1 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2020-14355

spice: multiple buffer overflow vulnerabilities in QUIC decoding code

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

CVSS 3.1 · 6.6 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 9 more
CVE-2020-13254

django: potential data leakage via malformed memcached keys

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

CVSS 3.1 · 5.9 Medium EPSS 6.1% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 4 more
Products
Ubuntu Linux Debian Linux Django and 5 more
CVE-2020-12692

openstack-keystone: failure to check signature TTL of the EC2 credential auth method

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2020-12691

openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2020-12690

openstack-keystone: OAuth1 request token authorize silently ignores roles parameter

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack
CVE-2020-12689

openstack-keystone: EC2 and credential endpoints are not protected from a scoped context

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2020-11078

CRLF injection in httplib2

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

CVSS 3.1 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Fedoraproject Httplib2 Project and 1 more
Products
Debian Linux Fedora Httplib2 and 3 more
CVE-2020-10756

QEMU: slirp: networking out-of-bounds read information disclosure vulnerability

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Libslirp Project and 2 more
Products
Ubuntu Linux Debian Linux Libslirp and 4 more
CVE-2020-10755

openstack-cinder: Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Openstack Openstack-cinder
CVE-2020-10753

ceph: radosgw: HTTP header injection via CORS ExposeHeader tag

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Fedoraproject Linuxfoundation and 2 more
Products
Ubuntu Linux Fedora Ceph and 3 more
CVE-2020-10731

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack Platform
CVE-2020-10724

dpdk: librte_vhost Missing inputs validation in Vhost-crypto

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Dpdk Fedoraproject and 1 more
Products
Ubuntu Linux Data Plane Development Kit Fedora and 2 more
CVE-2020-10723

dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Dpdk Fedoraproject and 3 more
Products
Ubuntu Linux Data Plane Development Kit Fedora and 7 more