Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2017-7549

instack-undercloud: uses hardcoded /tmp paths

A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

CVSS 3.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Instack-undercloud Openstack Openstack-director
CVE-2015-5303

python-rdomanager-oscplugin: NeutronMetadataProxySharedSecret parameter uses default value

The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.

CVSS 3.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Openstack Redhat
Products
Tripleo Heat Templates Openstack-director
CVE-2015-5306

openstack-ironic-discoverd: potential remote code execution with debug mode enabled

OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed
Vendors
Openstack Redhat
Products
Ironic Inspector Openstack Openstack-director
CVE-2015-5329

openstack-tripleo-heat-templates: Using hardcoded rabbitmq credentials regardless of supplied values

The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the default credentials.

CVSS 3.0 · 7.3 High EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack-director
CVE-2016-4474

overcloud-full: Default root password set

The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack-director
CVE-2015-5271

openstack-tripleo-heat-templates: unsafe pipeline ordering of swift staticweb middleware

The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Tripleo Heat Templates Openstack Openstack-director
CVE-2019-10141

openstack-ironic-inspector: SQL Injection vulnerability when receiving introspection data

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

CVSS 3.0 · 8.3 High EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Ironic-inspector Enterprise Linux Openstack and 1 more
CVE-2018-1000115

memcached: UDP server support allows spoofed traffic amplification DoS

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

CVSS 3.0 · 7.5 High EPSS 88.0% KEV · Not listed
Vendors
Canonical Debian Memcached and 1 more
Products
Ubuntu Linux Debian Linux Memcached and 2 more
CVE-2017-2637

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.

CVSS 3.0 · 9.9 Critical EPSS 4.6% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack-director