Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 193

Export CSV
CVE-2021-40085

openstack-neutron: arbitrary dnsmasq reconfiguration via extra_dhcp_opts

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Neutron Openstack
CVE-2021-3654

openstack-nova: novnc allows open redirection

A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

CVSS 3.1 · 6.1 Medium EPSS 26.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack Openstack Platform
CVE-2021-20267

openstack-neutron: Anti-spoofing bypass using Open vSwitch

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.

CVSS 3.1 · 7.1 High EPSS 1.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack Platform
CVE-2020-9543

openstack-manila: User with share-network UUID is able to show, create and delete shares

OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed
Vendors
Openstack Redhat
Products
Manila Openstack
CVE-2020-29565

python-django-horizon: dashboard allows open redirect

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Horizon Openstack
CVE-2020-17376

openstack-nova: Soft reboot after live-migration reverts instance to original source domain XML

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

CVSS 3.1 · 8.3 High EPSS 1.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2020-12692

openstack-keystone: failure to check signature TTL of the EC2 credential auth method

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2020-12691

openstack-keystone: Credentials endpoint policy logic allows changing credential owner and target project ID

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2020-12690

openstack-keystone: OAuth1 request token authorize silently ignores roles parameter

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack
CVE-2020-12689

openstack-keystone: EC2 and credential endpoints are not protected from a scoped context

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2019-9735

openstack-neutron: incorrect validation of port settings in iptables security group driver

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

CVSS 3.0 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Neutron Openstack
CVE-2019-3895

openstack-tripleo-common: Allows running new amphorae based on arbitrary images

An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.

CVSS 3.1 · 8.0 High EPSS 1.6% KEV · Not listed
Vendors
Openstack Redhat
Products
Octavia Openstack
CVE-2019-3830

openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files

A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Ceilometer Openstack
CVE-2019-19687

openstack-keystone: Credentials API allows non-admin to list and retrieve all users credentials

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack
CVE-2019-14433

openstack-nova: Nova server resource faults leak external exception details

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Openstack and 1 more
Products
Ubuntu Linux Debian Linux Nova and 1 more
CVE-2019-10876

openstack-neutron: DOS via broken port range merging in security group

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2019-10141

openstack-ironic-inspector: SQL Injection vulnerability when receiving introspection data

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

CVSS 3.0 · 8.3 High EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Ironic-inspector Enterprise Linux Openstack and 1 more
CVE-2018-16856

openstack-octavia: Private keys written to world-readable log files

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Octavia Openstack
CVE-2018-14635

openstack-neutron: A router interface out of subnet IP range results in a denial of service

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2018-14432

openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

CVSS 3.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Openstack Redhat
Products
Debian Linux Keystone Openstack