suse/openstack-keystone&distro=HPE Helion OpenStack 8

Vulnerabilities (58)

• CVE-2019-2627Apr 23, 2019
  affected < 12.0.4~dev4-5.27.4fixed 12.0.4~dev4-5.27.4

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with networ

• CVE-2019-2614Apr 23, 2019
  affected < 12.0.4~dev4-5.27.4fixed 12.0.4~dev4-5.27.4

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network acces

• CVE-2019-11068Apr 10, 2019
  affected < 12.0.4~dev2-5.19.2fixed 12.0.4~dev2-5.19.2

  libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

• CVE-2019-10876Apr 5, 2019
  affected < 12.0.4~dev2-5.19.2fixed 12.0.4~dev2-5.19.2

  An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes

• CVE-2019-3828Mar 27, 2019
  affected < 12.0.4~dev11-5.33.2fixed 12.0.4~dev11-5.33.2

  Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

• CVE-2019-9735Mar 13, 2019
  affected < 12.0.4~dev2-5.22.2fixed 12.0.4~dev2-5.22.2

  An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example,

• CVE-2019-6975Feb 11, 2019
  affected < 12.0.4~dev2-5.19.2fixed 12.0.4~dev2-5.19.2

  Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

• CVE-2019-3498Jan 9, 2019
  affected < 12.0.4~dev2-5.19.2fixed 12.0.4~dev2-5.19.2

  In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a use

• CVE-2018-19039Dec 13, 2018
  affected < 12.0.4~dev4-5.27.4fixed 12.0.4~dev4-5.27.4

  Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

• CVE-2018-1000808Oct 8, 2018
  affected < 12.0.3~dev1-5.16.3fixed 12.0.3~dev1-5.16.3

  Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploit

• CVE-2018-1000807Oct 8, 2018
  affected < 12.0.3~dev1-5.16.3fixed 12.0.3~dev1-5.16.3

  Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitab

• CVE-2018-15727Aug 29, 2018
  affected < 12.0.4~dev4-5.27.4fixed 12.0.4~dev4-5.27.4

  Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

• CVE-2018-14574Aug 3, 2018
  affected < 12.0.4~dev2-5.19.2fixed 12.0.4~dev2-5.19.2

  django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

• CVE-2018-14432Jul 31, 2018
  affected < 12.0.1~dev19-5.8.3fixed 12.0.1~dev19-5.8.3

  In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access

• CVE-2017-17051HigDec 5, 2017
  affected < 12.0.4~dev2-5.22.2fixed 12.0.4~dev2-5.22.2

  An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This

• CVE-2017-1000246MedNov 17, 2017
  affected < 12.0.4~dev11-5.33.2fixed 12.0.4~dev11-5.33.2

  Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

• CVE-2016-10127CriMar 3, 2017
  affected < 12.0.4~dev4-5.27.4fixed 12.0.4~dev4-5.27.4

  PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

• CVE-2015-3448Apr 29, 2015
  affected < 12.0.4~dev2-5.22.2fixed 12.0.4~dev2-5.22.2

  REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.