Redhat

Openstack

214 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4

CVE-2014-3708

Exploit
  • EPSS 1.06%
  • Veröffentlicht 31.10.2014 14:55:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request.

2.1

CVE-2014-7230

  • EPSS 0.12%
  • Veröffentlicht 08.10.2014 19:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.

2.1

CVE-2014-7231

Exploit
  • EPSS 0.16%
  • Veröffentlicht 08.10.2014 19:55:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by read...

4

CVE-2014-3621

Exploit
  • EPSS 0.43%
  • Veröffentlicht 02.10.2014 14:55:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the pub...

5

CVE-2014-4615

  • EPSS 0.75%
  • Veröffentlicht 19.08.2014 18:55:02
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUT...

4.3

CVE-2014-0040

Exploit
  • EPSS 0.26%
  • Veröffentlicht 02.06.2014 15:55:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent up...

4.3

CVE-2014-0041

  • EPSS 0.26%
  • Veröffentlicht 02.06.2014 15:55:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via u...

4.3

CVE-2014-0042

Exploit
  • EPSS 0.26%
  • Veröffentlicht 02.06.2014 15:55:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to in...

5

CVE-2013-6470

  • EPSS 0.28%
  • Veröffentlicht 02.06.2014 15:55:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by c...

6.4

CVE-2014-0071

  • EPSS 0.19%
  • Veröffentlicht 17.04.2014 14:55:06
  • Zuletzt bearbeitet 12.04.2025 10:46:40

PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.