Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 193

Export CSV
CVE-2022-47950

openstack-swift: Arbitrary file access through custom S3 XML entities

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Swift Openstack
CVE-2022-3100

openstack-barbican: access policy bypass via query string injection

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Barbican Enterprise Linux Eus Openstack and 2 more
CVE-2022-47951

openstack: Arbitrary file access through custom VMDK flat descriptor

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

CVSS 3.1 · 5.7 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Cinder Glance and 2 more
CVE-2024-29156

YAQL: OpenStack Murano Component Information Leakage

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Murano Yaql Openstack
CVE-2022-3277

openstack-neutron: unrestricted creation of security groups

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack Openstack Platform
CVE-2022-4134

openstack: glance & ceph conflict which allows image tampering

A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.

CVSS 3.1 · 2.8 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Glance Openstack
CVE-2022-3101

tripleo-ansible: /var/lib/mistral/overcloud discoverable

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Tripleo Ansible Openstack Openstack For Ibm Power
CVE-2022-3146

tripleo-ansible: /etc/openstack/clouds.yaml discoverable

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Tripleo Ansible Openstack Openstack For Ibm Power
CVE-2021-3563

Keystone: Verification of application credentials is silently length-limited

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 7.4 High EPSS 2.0% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Keystone Openstack Platform
CVE-2017-18017

kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c

The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.

CVSS 3.1 · 9.8 Critical EPSS 52.8% KEV · Not listed
Vendors
Arista Canonical Debian and 6 more
Products
Eos Ubuntu Linux Debian Linux and 30 more
CVE-2023-1636

Incomplete container isolation

A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Barbican Openstack Openstack Platform
CVE-2023-1633

Insecure barbican configuration file leaking credential

A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Barbican Openstack Openstack Platform
CVE-2023-1625

Information leak in api

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Heat Openstack Openstack Platform
CVE-2022-37394

openstack-nova: Compute service fails to restart if the vnic_type of a bound port changed from direct to macvtap

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2022-2447

Openstack: Application credential token remains valid longer than expected

A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack Openstack Platform and 2 more
CVE-2022-23452

openstack-barbican: Barbican allows anyone with an admin role to add their secrets to a different project's containers

An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.

CVSS 3.1 · 4.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Openstack Redhat
Products
Barbican Openstack Openstack Platform
CVE-2022-23451

openstack-barbican: Barbican allows authenticated users to add/modify/delete arbitrary metadata on any secret

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Openstack Redhat
Products
Barbican Openstack Openstack Platform
CVE-2022-0718

python-oslo-utils: incorrect password masking in debug output

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Oslo.utils Openshift Container Platform and 2 more
CVE-2021-4180

openstack-tripleo-heat-templates: data leak of internal URL through keystone_authtoken

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Tripleo Heat Templates Openstack
CVE-2021-40797

openstack-neutron: Routes middleware memory leak for nonexistent controllers

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack