openstack-aodh: Aodh can be used to launder Keystone trusts

A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious us...

django-saml2-auth (>=1.0.2b1, <=1.1.4), django-saml2-auth-custom (>=1.0.0, <=1.0.4) +4 more potentially affected by CVE-2017-1000433 via pysaml2 (>=4.0.2, <=4.4.0)

pysaml2 PYPI version =4.0.2, =1.0.2b1, =1.0.0, =12.0.2, =0.6.1, =3.4.8 Source cves: CVE-2017-1000433 Source advisory: MEND:CVE-2017-1000433...

kadm (>=0.1.3, <=0.5.4), kadm-plugin-cms (>=0.3.1, <=0.3.2) potentially affected by CVE-2017-16570 via keystone (>=4.0.0-beta.1, <=4.0.0-beta.4)

keystone NPM version =4.0.0-beta.1, =0.1.3, =0.3.1, =0.3.2 Source cves: CVE-2017-16570 Source advisory: OSV:GHSA-Q43C-G2G7-6GXJ...

kadm (>=0.1.3, <=0.5.4), kadm-plugin-cms (>=0.3.1, <=0.3.2) potentially affected by CVE-2017-16570 via keystone (>=4.0.0-beta.1, <=4.0.0-beta.4)

keystone NPM version =4.0.0-beta.1, =0.1.3, =0.3.1, =0.3.2 Source cves: CVE-2017-16570 Source advisory: GHSA-Q43C-G2G7-6GXJ...

GHSA-Q43C-G2G7-6GXJ Cross-Site Request Forgery (CSRF) in keystone

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Request Forgery CSRF. The package fails to validate the presence of the X-CSRF-Token header, which may allow attackers to carry actions on behalf of other users on all endpoints. Recommendation Update to version 4.0.0 or later...

Cross-Site Request Forgery (CSRF) in keystone

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Request Forgery CSRF. The package fails to validate the presence of the X-CSRF-Token header, which may allow attackers to carry actions on behalf of other users on all endpoints. Recommendation Update to version 4.0.0 or later...

GHSA-7CV6-GVX3-M54M Cross-Site Scripting in keystone

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting XSS. The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an...

Cross-Site Scripting in keystone

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting XSS. The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an...

Cross-Site Scripting in keystone

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize user input on the Contact Us page, allowing attackers to submit contact forms with malicious JavaScript in the message field. The output is not properly encoded leading an admin that open...

kadm (>=0.1.3, <=0.5.4), kadm-plugin-cms (>=0.3.1, <=0.3.2) potentially affected by CVE-2017-15878 via keystone (>=4.0.0-beta.1, <=4.0.0-beta.4)

keystone NPM version =4.0.0-beta.1, =0.1.3, =0.3.1, =0.3.2 Source cves: CVE-2017-15878 Source advisory: GHSA-7QCX-JMRC-H2RR...

kadm (>=0.1.3, <=0.5.4), kadm-plugin-cms (>=0.3.1, <=0.3.2) potentially affected by CVE-2017-15878 via keystone (>=4.0.0-beta.1, <=4.0.0-beta.4)

keystone NPM version =4.0.0-beta.1, =0.1.3, =0.3.1, =0.3.2 Source cves: CVE-2017-15878 Source advisory: OSV:GHSA-7QCX-JMRC-H2RR...

GHSA-7QCX-JMRC-H2RR Cross-Site Scripting in keystone

Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize user input on the Contact Us page, allowing attackers to submit contact forms with malicious JavaScript in the message field. The output is not properly encoded leading an admin that open...

openstack-aodh: Aodh can be used to launder Keystone trusts

A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious us...

Moderate: Red Hat Security Advisory: openstack-aodh security update

An update for openstack-aodh is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2017-16570

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7KEYJS03. In other words, it fails to reject requests that lack an x-csrf-token header...

act-copy (>=1.0.0, <=1.0.1), d-pac.cms (0.5.7) +19 more potentially affected by CVE-2017-16570 via keystone (>=0.2.26, <=4.0.0-beta.4)

keystone NPM version =0.2.26, =1.0.0, =0.1.5, =0.1.3, =0.3.1, =0.0.9, =0.2.0, =0.0.1, =0.0.1, =1.0.2, =0.0.0, =0.1.0 and more Source cves: CVE-2017-16570 Source advisory: MEND:CVE-2017-16570...

Cross-site Request Forgery (CSRF)

keystone is vulnerable to cross-site request forgery CSRF attacks. If a malicious request is made without the presence of CSRF headers/values, attackers are able to bypass the CSRF protections. This is because the library fails to validate a request which doesn't contain the x-csrf-token header...

Cross-site Scripting (XSS)

keystone is vulnerable to cross-site scripting XSS attacks. Authenticated administrators can leverage the lack of sanitization in the content brief and content extended fields to inject and execute arbitrary webscript...

CSV Injection

keystone is vulnerable to CSV injection attacks. These attacks are possible because of a mishandled value during the exporting of a CSV file...

Cross-site Scripting (XSS)

keystone is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the fields/types/markdown/MarkdownType.js file because the markdown is not sanitized. This allows attackers to inject and execute arbitrary webscript...