Vulnerabilities for Openstack platform (...) - CXSECURITY.COM

Vulnerabilities for 'Openstack platform'

2022-05-10

CVE-2022-0866

CWE-863

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

2022-03-02

CVE-2021-3654

CWE-601

A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

2021-03-23

CVE-2021-20270

CWE-835

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

2020-12-18

CVE-2020-27781

CWE-522

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 16.2.0.

2020-10-06

CVE-2020-25743

CWE-476

hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.

2020-09-23

CVE-2020-14365

CWE-347

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

2017-11-27

CVE-2017-15114

CWE-295

When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services. As no additional authentication is configured this allows these services to connect to libvirtd (which is equivalent to root access). If a vulnerability exists in another service it could, combined with this flaw, be exploited to escalate privileges to gain control over compute nodes.

>>> Vendor: Redhat 373 Products

Certificate server

Directory server

Enterprise linux

Enterprise linux desktop

Linux powertools

Redhat package manager

Docbook stylesheets

Pre-execution environment

Linux advanced workstation

Analog real-time synthesizer

Kdelibs sound devel

Package manager

Jboss application server

Network satelite server

Network satellite server

Enterprise linux desktop workstation

Fedora directory server

Desktop workstation

Certificate system

Jboss enterprise application platform

dogtag certificate system

Cluster project

Dogtag certificate system

Enterprise virtualization

Network satellite

Enterprise virtualization hypervisor

Enterprise virtualization manager

Jboss enterprise service bus

Jboss enterprise soa platform

Jboss enterprise web platform

389 directory server

Policycoreutils

Jboss seam 2 framework

Virtualization manager

See all Products for Vendor Redhat

Copyright 2024, cxsecurity.com