openstack essex vulnerabilities and exploits

(subscribe to this query)

2.1

CVSSv2

Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.

Openstack Horizon 2012.2 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0

2.1

CVSSv2

The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package prior to 2012.1.1) is world readable and exposes the secret key value.

Redhat Openstack 2.0 Openstack Horizon Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 18

5

CVSSv2

openstack-utils openstack-db has insecure password creation

Redhat Openstack 2.1 Redhat Openstack 3.0 Redhat Openstack 4.0 Redhat Openstack Essex -

5

CVSSv2

OpenStack Keystone Grizzly prior to 2013.1, Folsom 2012.1.3 and previous versions, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent malicious users to bypass access restrict...

Openstack Keystone 2013.1 Openstack Keystone

2.1

CVSSv2

Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files.

Redhat Openstack Essex -Redhat Openstack Folsom -

4.4

CVSSv2

PackStack 2012.2.3 in Red Hat OpenStack Essex and Folsom can create the answer file in insecure directories such as /tmp or the current working directory, which allows local users to modify deployed systems by changing this file.

Redhat Openstack Folsom -Redhat Packstack 2012.2.3 Redhat Openstack Essex -

5

CVSSv2

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote malicious users to cause a denial of service (resource consump...

Openstack Cinder Folsom -Openstack Keystone Essex -Openstack Folsom -Openstack Grizzly -Openstack Compute \\(nova\\) Essex -Openstack Compute \\(nova\\) Folsom -

5

CVSSv2

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote malicious users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, ...

Openstack Folsom -Openstack Keystone Essex -

4

CVSSv2

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to th...

Openstack Folsom 2012.2 Openstack Grizzly 2012.2 Openstack Essex 2012.1 Canonical Ubuntu Linux 11.10 Canonical Ubuntu Linux 12.10 Canonical Ubuntu Linux 12.04

3.5

CVSSv2

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

Openstack Glance V1

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook