CVE-2015-5271

openstack-tripleo-heat-templates: unsafe pipeline ordering of swift staticweb middleware

The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Tripleo Heat Templates Openstack Openstack-director

CVE-2015-5286

openstack-glance: Storage overrun by deleting images

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Image Registry And Delivery Service \(glance\) Openstack

CVE-2015-5295

openstack-heat: Vulnerability in Heat template validation leading to DoS

The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

CVSS 3.0 · 5.4 Medium EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Openstack Oracle and 1 more

Products

Fedora Orchestration Api Solaris and 1 more

CVE-2015-5303

python-rdomanager-oscplugin: NeutronMetadataProxySharedSecret parameter uses default value

The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.

CVSS 3.0 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Openstack Redhat

Products

Tripleo Heat Templates Openstack-director

CVE-2015-7548

openstack-nova: Unprivileged API user can access host data using instance snapshot

OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot.

CVSS 3.0 · 3.5 Low EPSS 1.8% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2015-7713

openstack-nova: network security group changes are not applied to running instances

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

CVSS 2.0 · 5.0 Medium EPSS 3.7% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2015-8914

openstack-neutron: ICMPv6 source address spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.

CVSS 3.0 · 9.1 Critical EPSS 4.3% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2016-0737

openstack-swift: Client to proxy DoS through Large Objects

OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Openstack Redhat

Products

Swift Openstack Storage

CVE-2016-0738

openstack-swift: Proxy to server DoS through Large Objects

OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Openstack Redhat

Products

Swift Openstack Storage

CVE-2016-0757

openstack-glance: Glance image status manipulation through locations

OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.

CVSS 3.0 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Image Registry And Delivery Service \(glance\) Openstack

CVE-2016-2140

openstack-nova: Host data leak through resize/migration

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2016-4428

python-django-horizon: XSS in client side template

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

CVSS 3.1 · 5.4 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Openstack Redhat

Products

Debian Linux Horizon Enterprise Linux and 1 more

CVE-2016-5362

openstack-neutron: DHCP spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.

CVSS 3.0 · 8.2 High EPSS 3.4% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2016-5363

openstack-neutron: MAC source address spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.

CVSS 3.0 · 8.2 High EPSS 3.3% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2016-9185

openstack-heat: Template source URL allows network port scan

In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.

CVSS 3.0 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Heat Openstack

CVE-2012-3542

Keystone: Lack of authorization for adding users to tenants

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Essex Horizon Openstack

CVE-2013-1664

bindings: Internal entity expansion in Python XML libraries inflicts DoS vulnerabilities

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

CVSS 2.0 · 5.0 Medium EPSS 4.8% KEV · Not listed

Vendors

Openstack Redhat

Products

Cinder Folsom Compute \(nova\) Essex Compute \(nova\) Folsom and 4 more

CVE-2013-1665

bindings: External entity expansion in Python XML libraries inflicts potential security flaws and DoS vulnerabilities

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

CVSS 2.0 · 5.0 Medium EPSS 4.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Folsom Keystone Essex Openstack

CVE-2013-1838

Nova: DoS by allocating all Fixed IPs

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.

CVSS 2.0 · 4.0 Medium EPSS 2.7% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Essex Folsom and 2 more

CVE-2013-0282

Keystone: EC2-style authentication accepts disabled user/tenants

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed

Vendors

Openstack Redhat

Products

Keystone Openstack