rpm package
suse/openstack-tempest&distro=SUSE OpenStack Cloud 7
pkg:rpm/suse/openstack-tempest&distro=SUSE%20OpenStack%20Cloud%207
Vulnerabilities (35)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-16865 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Oct 4, 2019 | An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. | ||
| CVE-2019-15043 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Sep 3, 2019 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana. | ||
| CVE-2019-15026 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Aug 30, 2019 | memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c. | ||
| CVE-2019-5477 | — | < 12.2.1~a0~dev177-4.6.3 | 12.2.1~a0~dev177-4.6.3 | Aug 16, 2019 | A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input a | ||
| CVE-2019-0201 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | May 23, 2019 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuth | ||
| CVE-2019-11596 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Apr 29, 2019 | In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c. | ||
| CVE-2019-3828 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Mar 27, 2019 | Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. | ||
| CVE-2019-3498 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Jan 9, 2019 | In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a use | ||
| CVE-2018-19039 | — | < 12.2.1~a0~dev177-4.6.3 | 12.2.1~a0~dev177-4.6.3 | Dec 13, 2018 | Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. | ||
| CVE-2018-15727 | — | < 12.2.1~a0~dev177-4.6.3 | 12.2.1~a0~dev177-4.6.3 | Aug 29, 2018 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. | ||
| CVE-2018-1000115 | — | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Mar 5, 2018 | Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported | ||
| CVE-2017-1000246 | Med | 5.3 | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Nov 17, 2017 | Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data. | |
| CVE-2017-4967 | Med | 6.1 | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Jun 13, 2017 | An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the | |
| CVE-2017-4965 | Med | 6.1 | < 12.2.1~a0~dev177-4.9.1 | 12.2.1~a0~dev177-4.9.1 | Jun 13, 2017 | An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the | |
| CVE-2016-10127 | Cri | 9.0 | < 12.2.1~a0~dev177-4.6.3 | 12.2.1~a0~dev177-4.6.3 | Mar 3, 2017 | PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. |
- CVE-2019-16865Oct 4, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
- CVE-2019-15043Sep 3, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
- CVE-2019-15026Aug 30, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.
- CVE-2019-5477Aug 16, 2019affected < 12.2.1~a0~dev177-4.6.3fixed 12.2.1~a0~dev177-4.6.3
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input a
- CVE-2019-0201May 23, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuth
- CVE-2019-11596Apr 29, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
- CVE-2019-3828Mar 27, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
- CVE-2019-3498Jan 9, 2019affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a use
- CVE-2018-19039Dec 13, 2018affected < 12.2.1~a0~dev177-4.6.3fixed 12.2.1~a0~dev177-4.6.3
Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
- CVE-2018-15727Aug 29, 2018affected < 12.2.1~a0~dev177-4.6.3fixed 12.2.1~a0~dev177-4.6.3
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
- CVE-2018-1000115Mar 5, 2018affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported
- affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
- affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the
- affected < 12.2.1~a0~dev177-4.9.1fixed 12.2.1~a0~dev177-4.9.1
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the
- affected < 12.2.1~a0~dev177-4.6.3fixed 12.2.1~a0~dev177-4.6.3
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Page 2 of 2