CVE-2015-5271

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

PT-2016-3678 · Openstack · Tripleo-Heat-Templates

Name of the Vulnerable Software and Affected Versions: tripleo-heat-templates affected versions not specified Description: The issue is related to the improper ordering of the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when...

TripleO Heat templates design flaw

TripleO Heat templates tripleo-heat-templates is a set of tools for describing samples of multi-host infrastructure. A security vulnerability exists in TripleO Heat templates. When the program is deployed using the command line interface, a remote attacker can exploit this vulnerability to forge...

Red Hat Enterprise Linux OpenStack Platform Information Disclosure Vulnerability

Red Hat Enterprise Linux OpenStack Platform is an open source IaaS Infrastructure-as-a-Service solution from Red Hat, Inc. The solution supports the creation and management of private, public, and hybrid clouds.TripleO Heat templates tripleo-heat-templates is a set of tools for describing a sampl...

CVE-2015-5329

The TripleO Heat templates tripleo-heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the...

CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

Code injection

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

Default credentials

The TripleO Heat templates tripleo-heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the...

PYSEC-2016-35

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

PYSEC-2016-35

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

UBUNTU-CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

CVE-2015-5329

The CVE-2015-5329 issue affects TripleO Heat templates (tripleo-heat-templates) used with Red Hat Enterprise Linux OpenStack Platform 7.0. The root cause is improper use of RabbitMQ credentials, leading deployed overcloud services to be accessible with default credentials (guest/guest). Descripti...

CVE-2015-5303

The CVE-2015-5303 entry concerns TripleO Heat templates (tripleo-heat-templates). When deployed from the CLI, it allows remote attackers to spoof OpenStack Networking metadata requests by exploiting knowledge of the default value of the NeutronMetadataProxySharedSecret parameter. The vulnerabilit...

CVE-2015-5329

The TripleO Heat templates tripleo-heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the...

CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

PT-2016-3682 · Pivotal +1 · Rabbitmq +1

Name of the Vulnerable Software and Affected Versions: tripleo-heat-templates versions 7.0 Description: The issue is related to the improper use of configured RabbitMQ credentials in the TripleO Heat templates, making it easier for remote attackers to obtain access to services in deployed...

Jungle Heat: Weapon of Revenge - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Jungle Heat: Weapon of Revenge published at the 'play' market has multiple vulnerabilities...

openstack-heat: Vulnerability in Heat template validation leading to DoS

A vulnerability was discovered in the OpenStack Orchestration service heat, where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use...

openstack-heat: Vulnerability in Heat template validation leading to DoS

A vulnerability was discovered in the OpenStack Orchestration service heat, where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use...