rpm package
suse/openstack-heat-templates&distro=SUSE OpenStack Cloud Crowbar 8
pkg:rpm/suse/openstack-heat-templates&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208
Vulnerabilities (65)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-14432 | — | < 0.0.0+git.1525957319.6b5a7cd-3.3.3 | 0.0.0+git.1525957319.6b5a7cd-3.3.3 | Jul 31, 2018 | In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access | ||
| CVE-2017-11481 | Med | 6.1 | < 0.0.0+git.1623056900.7917e18-3.21.3 | 0.0.0+git.1623056900.7917e18-3.21.3 | Dec 8, 2017 | Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. | |
| CVE-2017-1000246 | Med | 5.3 | < 0.0.0+git.1582270132.8a20477-3.15.1 | 0.0.0+git.1582270132.8a20477-3.15.1 | Nov 17, 2017 | Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data. | |
| CVE-2017-11499 | Hig | 7.5 | < 0.0.0+git.1623056900.7917e18-3.21.3 | 0.0.0+git.1623056900.7917e18-3.21.3 | Jul 25, 2017 | Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building | |
| CVE-2017-5929 | Cri | 9.8 | < 0.0.0+git.1623056900.7917e18-3.21.3 | 0.0.0+git.1623056900.7917e18-3.21.3 | Mar 13, 2017 | QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. |
- CVE-2018-14432Jul 31, 2018affected < 0.0.0+git.1525957319.6b5a7cd-3.3.3fixed 0.0.0+git.1525957319.6b5a7cd-3.3.3
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access
- affected < 0.0.0+git.1623056900.7917e18-3.21.3fixed 0.0.0+git.1623056900.7917e18-3.21.3
Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- affected < 0.0.0+git.1582270132.8a20477-3.15.1fixed 0.0.0+git.1582270132.8a20477-3.15.1
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
- affected < 0.0.0+git.1623056900.7917e18-3.21.3fixed 0.0.0+git.1623056900.7917e18-3.21.3
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building
- affected < 0.0.0+git.1623056900.7917e18-3.21.3fixed 0.0.0+git.1623056900.7917e18-3.21.3
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Page 4 of 4