Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2018-14635

openstack-neutron: A router interface out of subnet IP range results in a denial of service

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2018-14620

openstack-rabbitmq-container: Insecure download of rabbitmq_clusterer during docker build

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the image builder and install in the resultant container image. Version of openstack-rabbitmq-container and openstack-containers as shipped with Red Hat Openstack 12, 13, 14 are believed to be vulnerable.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack
CVE-2018-14432

openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVSS 3.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Keystone Openstack
CVE-2018-12326

redis: Code execution in redis-cli via crafted command line arguments

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.

CVSS 3.0 · 8.4 High EPSS 2.6% KEV · Not listed
Vendors
Redhat Redislabs
Products
Openstack Rhel Software Collections Redis
CVE-2018-11806

QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams

m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2018-10915

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.

CVSS 3.0 · 8.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 9 more
CVE-2018-10903

python-cryptography: GCM tag forgery via truncated tag in finalize_with_tag API

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Canonical Cryptography Redhat
Products
Ubuntu Linux Python-cryptography Openstack
CVE-2018-10899

jolokia: system-wide CSRF that could lead to Remote Code Execution

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.

CVSS 3.0 · 8.1 High EPSS 2.7% KEV · Not listed
Vendors
Jolokia Redhat
Products
Jolokia Jboss Amq Jboss Fuse and 1 more
CVE-2018-10898

openstack-tripleo-heat-templates: Default ODL deployment uses hard coded administrative credentials

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Tripleo Heat Templates Openstack
CVE-2018-10892

docker: container breakout without selinux in enforcing mode

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Docker Mobyproject Opensuse and 1 more
Products
Docker Moby Leap and 4 more
CVE-2018-10875

ansible: ansible.cfg is being read from current working directory allowing possible code execution

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Ansible Engine and 9 more
CVE-2018-10874

ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Enterprise Linux Openstack and 2 more
CVE-2018-10855

ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

CVSS 3.1 · 5.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Ansible Engine and 5 more
CVE-2018-10237

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Guava Banking Payments Communications Ip Service Activator and 18 more
CVE-2018-1000808

pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.0 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Pyopenssl Project Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 4 more
CVE-2018-1000807

pyOpenSSL: Use-after-free in X509 object handling

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Pyopenssl Redhat
Products
Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 3 more
CVE-2018-1000127

memcached: Integer Overflow in items.c:item_free()

memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Memcached and 1 more
Products
Ubuntu Linux Debian Linux Memcached and 1 more