Security Bulletin: Openstack Compute (Neutron) noVNC proxy

Summary Fix OpenStack Neutron allowing a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the noVNC component. By modifying untrusted URL input using multiple backslashes, an attacker could exploit this vulnerability to redirect a victim to arbitrary websit...

Debian: Security Advisory (DLA-2781-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-4983-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2781-1] neutron security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2781-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 11, 2021 https://wiki.debian.org/LTS -...

Debian DSA-4983-1 : neutron - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4983 advisory. Pavel Toporkov discovered a vulnerability in Neutron, the OpenStack virtual network service, which allowed a reconfiguration of dnsmasq via crafted...

DLA-2781-1 neutron - security update

Bulletin has no description...

Debian DLA-2781-1 : neutron - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2781 advisory. - An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted...

[SECURITY] [DSA 4983-1] neutron security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4983-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 10, 2021 https://www.debian.org/security/faq -...

DSA-4983-1 neutron - security update

Bulletin has no description...

The vulnerability of the Open vSwitch network service provided by Neutron, related to insufficient data authentication checks, allows attackers to access confidential data and cause service failures.

The vulnerability of the Open vSwitch network service provided by Neutron relates to insufficient verification of data authenticity. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, as well as cause service failures through specially crafted packets...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-neutron) security update

An update for openstack-neutron is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-neutron: arbitrary dnsmasq reconfiguration via extra_dhcp_opts

An input-validation flaw was found in openstack-neutron, where an authenticated attacker could change the dnsmasq configuration. By crafting extradhcpopts values, the attacker could crash the dnsmasq, change parameters for tenants sharing the same interface, or otherwise alter that daemon’s...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (openstack-neutron) security update

An update for openstack-neutron is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-neutron: arbitrary dnsmasq reconfiguration via extra_dhcp_opts

An input-validation flaw was found in openstack-neutron, where an authenticated attacker could change the dnsmasq configuration. By crafting extradhcpopts values, the attacker could crash the dnsmasq, change parameters for tenants sharing the same interface, or otherwise alter that daemon’s...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 10.0 (openstack-neutron) security update

An update for openstack-neutron is now available for Red Hat OpenStack Platform 10 Newton. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-neutron: arbitrary dnsmasq reconfiguration via extra_dhcp_opts

An input-validation flaw was found in openstack-neutron, where an authenticated attacker could change the dnsmasq configuration. By crafting extradhcpopts values, the attacker could crash the dnsmasq, change parameters for tenants sharing the same interface, or otherwise alter that daemon’s...

CVE-2021-40797

A resource-allocation flaw was found in openstack-neutron. An authenticated attacker could make API requests involving nonexistent controllers causing the API worker to consume increasing amounts of memory. This flaw could be exploited to force API performance degradation or denial of service...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (openstack-neutron) security update

An update for openstack-neutron is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-neutron: arbitrary dnsmasq reconfiguration via extra_dhcp_opts

An input-validation flaw was found in openstack-neutron, where an authenticated attacker could change the dnsmasq configuration. By crafting extradhcpopts values, the attacker could crash the dnsmasq, change parameters for tenants sharing the same interface, or otherwise alter that daemon’s...

CVE-2021-40797

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API...