openstack heat - vulnerabilities and exploits

(subscribe to this query)

NA

A missing permission check in Jenkins Openstack Heat Plugin 1.5 and previous versions allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Jenkins Openstack Heat

NA

A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and previous versions allows malicious users to connect to an attacker-specified URL.

Jenkins Openstack Heat

NA

Jenkins Openstack Heat Plugin 1.5 and previous versions does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Jenkins Openstack Heat

NA

A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.

Openstack Tripleo Heat Templates

5

CVSSv2

The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote malicious users to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.

Openstack Tripleo Heat Templates

4

CVSSv2

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would g...

Redhat Openstack 13 Redhat Openstack 16.1 Openstack Tripleo Heat Templates Redhat Openstack 16.2

NA

An information leak exists in OpenStack heat. This issue could allow a remote, authenticated malicious user to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availabilit...

Openstack Heat -Redhat Openstack Platform 16.1 Redhat Openstack Platform 13.0 Redhat Openstack Platform 16.2 Redhat Openstack Platform 17.0

6.5

CVSSv2

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines.

Redhat Openstack Platform 15.0 Redhat Openstack Platform 16.0 Redhat Openstack Platform 16.1

1 Article

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 prior to 2014.2.4 and 2015.1.x prior to 2015.1.1 allows remote malicious users to inject arbitrary web script or HTML via the description parameter in a heat templa...

Debian Debian Linux 8.0 Openstack Horizon 2014.2.0 Openstack Horizon 2014.2.1 Openstack Horizon 2015.1.0 Openstack Horizon 2014.2.2 Openstack Horizon 2014.2.3 Oracle Solaris 11.2

7.5

CVSSv2

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorize...

Openstack Magnum -

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook