Redhat Openstack Platform vulnerabilities

• hibernate hibernate-validator, red hat a-mq clients 2, cryostat 2 +29 more +31 more Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss CVE-2023-1932 Fix available 6.1 MediumNovember 7, 2024
• redhat openstack platform, red hat openstack platform 16.1, openstack platform 16.2 +2 more +4 more Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors CVE-2024-8007 Fix available 8.1 HighAugust 21, 2024
• openstack heat, red hat openstack platform 13 (queens), openstack platform 16.1 +3 more +5 more Openstack-heat: incomplete fix for cve-2023-1625 CVE-2024-7319 5.0 MediumAugust 2, 2024
• red hat openstack platform 16.1, openstack platform 16.2, openstack platform 17.1 +4 more +6 more Tripleo-ansible: bind keys are world readable CVE-2023-6725 Fix available 5.5 MediumMarch 15, 2024
• 9bis kitty, apache sshd, sshj +68 more +70 more Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795 Public exploitFix available EPSS 93.5% 5.9 MediumDecember 18, 2023
• red hat ironic content for red hat openshift container platform 4.12, openstack platform 17.1 for rhel 8, openstack platform 17.1 for rhel 9 +5 more +7 more Python-eventlet: patch regression for cve-2021-21419 in some red hat builds CVE-2023-5625 Fix available 5.3 MediumOctober 27, 2023
• openstack barbican, rdo openstack rdo, red hat openstack platform 13 (queens) +4 more +6 more Insecure barbican configuration file leaking credential CVE-2023-1633 Fix available 6.6 MediumSeptember 24, 2023
• openstack barbican, rdo openstack rdo, red hat openstack platform 13 (queens) +4 more +6 more Incomplete container isolation CVE-2023-1636 6.0 MediumSeptember 24, 2023
• red hat openstack platform 13.0 (queens) for rhel 7.6 eus, openstack platform 13.0 - els, redhat openstack platform +2 more Instack-undercloud: rsync leaks information to undercloud CVE-2022-3596 Fix available 7.5 HighSeptember 20, 2023
• red hat openstack platform 16.2, redhat openstack platform +1 more Plain-text passwords saved in /var/log/messages CVE-2022-3261 4.4 MediumSeptember 15, 2023
• red hat openstack platform 13 (queens) operational tools, openstack platform 16.1, openstack platform 16.2 +4 more +6 more Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277) CVE-2023-3637 Fix available 4.3 MediumJuly 25, 2023
• qemu, fedora extra packages for enterprise linux, fedora +8 more +10 more Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service CVE-2023-3354 Fix available 7.5 HighJuly 11, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• cloudbase open vswitch, debian linux, redhat fast datapath +3 more +5 more A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will... CVE-2023-1668 Fix available 8.2 HighApril 10, 2023
• redhat undertow, netapp oncommand workflow automation, red hat eap 7.4.10 release +31 more +33 more Undertow: infinite loop in sslconduit during close CVE-2023-1108 Fix available 7.5 HighApril 7, 2023
• openstack heat, rdo openstack rdo, red hat openstack platform 13 (queens) +4 more +6 more Information leak in api CVE-2023-1625 Fix available 7.4 HighMarch 27, 2023
• openstack neutron, the openstack project openstack-neutron, redhat openstack platform +2 more openstack-neutron uncontrolled resource consumption flaw CVE-2022-3277 Fix available 6.5 MediumMarch 6, 2023
• openstack barbican, redhat openstack, red hat openstack platform +1 more +3 more A flaw was found in the openstack-barbican component. This issue allows an access policy bypass... CVE-2022-3100 Fix available 5.9 MediumSeptember 29, 2022
• openstack keystone, [unknown] openstack-keystone, redhat openstack platform +2 more +4 more A flaw was found in OpenStack. The application credential tokens can be used even after they have... CVE-2022-2447 Fix available 6.6 MediumSeptember 1, 2022
• [unknown] dpdk, debian linux, dpdk data plane development kit +6 more +8 more A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker... CVE-2022-2132 Fix available 8.6 HighAugust 30, 2022
• openstack keystone, debian linux, redhat openstack platform +2 more Openstack Keystone Incorrect Authorization vulnerability CVE-2021-3563 Fix available 7.4 HighAugust 26, 2022
• qemu, fedoraproject extra packages for enterprise linux, fedora +2 more +4 more An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the... CVE-2020-14394 Fix available 3.2 LowAugust 17, 2022
• red hat wildfly, redhat jboss enterprise application platform, openstack platform +2 more This is a concurrency issue that can result in the wrong caller principal being returned from the... CVE-2022-0866 Fix available 5.3 MediumMay 10, 2022
• debian linux, openstack oslo.utils, redhat openshift container platform +1 more +3 more python-oslo-utils has improper password parsing CVE-2022-0718 Fix available 4.9 MediumMarch 23, 2022
• openstack nova, openstack-nova, redhat openstack platform +2 more Open Redirect in CPython that affects users of OpenStack Nova CVE-2021-3654 Fix available EPSS 26.8% 6.1 MediumMarch 2, 2022
• ceph, redhat ceph storage, fedoraproject fedora +5 more +7 more A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the... CVE-2021-3979 Fix available 6.5 MediumFebruary 19, 2022
• openstack barbican, redhat openstack platform +1 more openstack-barbican Denial of Service vulnerability CVE-2022-23452 Fix available 4.9 MediumJanuary 28, 2022
• openstack barbican, redhat openstack platform +1 more Barbican authorization flaw before v14.0.0 CVE-2022-23451 Fix available 8.1 HighJanuary 28, 2022
• redhat openstack-selinux, openstack platform +1 more An improper authorization flaw was discovered in openstack-selinux's applied policy where it does... CVE-2020-1690 Fix available 6.5 MediumJune 7, 2021
• openstack neutron, the openstack project openstack-neutron, redhat openstack platform +2 more Openstack Neutron has Insufficient Verification of IPv6 addresses CVE-2021-20267 Fix available 7.1 HighMay 28, 2021
• pygments, debian linux, fedoraproject fedora +5 more +7 more Infinite Loop in Pygments CVE-2021-20270 Fix available 7.5 HighMarch 9, 2021
• qemu, debian linux, fedoraproject fedora +5 more +7 more An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while... CVE-2021-20257 Fix available 6.5 MediumFebruary 23, 2021
• ceph, fedoraproject fedora, redhat ceph storage +2 more +4 more User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila,... CVE-2020-27781 Fix available 7.1 HighDecember 18, 2020
• python-rsa project python-rsa, fedoraproject fedora, redhat openstack platform +2 more Timing attacks in python-rsa CVE-2020-25658 Fix available 7.5 HighNovember 12, 2020
• qemu, redhat enterprise linux, openstack platform +2 more hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a... CVE-2020-25743 Fix available 3.2 LowOctober 6, 2020
• red hat ansible, redhat ansible engine, debian linux +3 more +5 more Improper Verification of Cryptographic Signature in ansible CVE-2020-14365 Fix available 7.1 HighSeptember 5, 2020
• redhat openstack platform A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16,... CVE-2020-10731 Fix available 9.9 CriticalJuly 31, 2020
• openstack designate, debian linux, redhat enterprise linux openstack platform +2 more Designate does not enforce the DNS protocol limit concerning record set sizes CVE-2015-5694 Fix available 6.5 MediumNovember 22, 2019
• qemu, debian linux, fedoraproject fedora +2 more +4 more The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service ... CVE-2019-12067 Fix available 6.5 MediumOctober 24, 2019
• redhat openstack platform When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it... CVE-2017-15114 8.1 HighNovember 27, 2017
• qemu, redhat enterprise linux desktop, enterprise linux eus +6 more +8 more Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other... CVE-2014-0148 Fix available 5.5 MediumOctober 28, 2014
• qemu, fedoraproject fedora, redhat enterprise linux desktop +7 more +9 more Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW... CVE-2014-0147 Fix available 6.2 MediumMarch 26, 2014
• qemu, redhat enterprise linux desktop, enterprise linux eus +6 more +8 more QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are... CVE-2014-0144 Fix available 8.6 HighMarch 26, 2014