GHSA-W8HX-F868-PVCH Openstack Neutron has Insufficient Verification of IPv6 addresses

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some...

com.lookout.jenkins:environment-script (1.2.5), org.jenkins-ci.plugins:ivy (>=1.25, <=1.26) +1 more potentially affected by CVE-2021-21643 via org.jenkins-ci.plugins:config-file-provider (2.7.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - com.lookout.jenkins:environment-script 1.2.5 - org.jenkins-ci.plugins:ivy...

com.lookout.jenkins:environment-script (1.2.5), org.jenkins-ci.plugins:ivy (>=1.25, <=1.26) +1 more potentially affected by CVE-2021-21644 via org.jenkins-ci.plugins:config-file-provider (2.7.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - com.lookout.jenkins:environment-script 1.2.5 - org.jenkins-ci.plugins:ivy...

GHSA-F8FH-XP28-Q59M OpenStack Horizon Open redirect in workflow forms

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provid...

OpenStack Horizon Open redirect in workflow forms

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provid...

GHSA-C7W7-9C85-4QXV OpenStack Nova Live migration fails to update persistent domain XML

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths ...

OpenStack Nova Live migration fails to update persistent domain XML

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths ...

org.jenkins-ci.main:jenkins-test-harness (1.596.3), org.jenkins-ci.main:jenkins-war (1.596.3) +4 more potentially affected by CVE-2020-2230 via org.jenkins-ci.main:jenkins-core (1.596.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.596.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.596.3 - org.jenkins-ci.main:jenkins-war 1.596.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.596.3), org.jenkins-ci.main:jenkins-war (1.596.3) +4 more potentially affected by CVE-2020-2229 via org.jenkins-ci.main:jenkins-core (1.596.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.596.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.596.3 - org.jenkins-ci.main:jenkins-war 1.596.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.596.3), org.jenkins-ci.main:jenkins-war (1.596.3) +4 more potentially affected by CVE-2020-2222 via org.jenkins-ci.main:jenkins-core (1.596.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.596.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.596.3 - org.jenkins-ci.main:jenkins-war 1.596.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.596.3), org.jenkins-ci.main:jenkins-war (1.596.3) +4 more potentially affected by CVE-2020-2223 via org.jenkins-ci.main:jenkins-core (1.596.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.596.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.596.3 - org.jenkins-ci.main:jenkins-war 1.596.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.596.3), org.jenkins-ci.main:jenkins-war (1.596.3) +4 more potentially affected by CVE-2020-2221 via org.jenkins-ci.main:jenkins-core (1.596.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.596.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.596.3 - org.jenkins-ci.main:jenkins-war 1.596.3 -...

OpenStack Mistral DoS

A Denial of Service DoS condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service...

GHSA-443J-6P7G-6V4W OpenStack Mistral DoS

A Denial of Service DoS condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service...

GHSA-V3M2-PG96-W33M Openstack cinder Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

Openstack cinder Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

GHSA-RQW2-HHRF-7936 OpenStack Keystone does not check signature TTL of the EC2 credential auth method

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

GHSA-4427-7F3W-MQV6 OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user...

OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user...

OpenStack Keystone does not check signature TTL of the EC2 credential auth method

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...