openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects

A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is...

Important: Red Hat Security Advisory: openstack-keystone security and bug fix update

An update for openstack-keystone is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 12.0 director security and bug fix update

An update for memcached is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update

An update for openstack-nova is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-nova: Swapping encrypted volumes can allow an attacker to corrupt the LUKS header causing a denial of service in the host

OpenStack Nova has a vulnerability in the handling of encrypted volumes. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. All Nova installations supporting...

[SECURITY] Fedora 27 Update: docker-latest-1.13.1-37.git9cb56fd.fc27

Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. Docker containers can encapsulate any payload, and will run consistently on and between virtually any server. The same container...

Debian DSA-4275-1 : keystone - security update

Kristi Nikolla discovered an information leak in Keystone, the OpenStack identity service, if running in a federated setup. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4275. The text itself is copyright C...

Debian: Security Advisory (DSA-4275-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Manager with OpenStack

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.20 used by IBM Cloud Manager with OpenStack. These issues were disclosed as part of IBM SDK, Java Technology Edition Quarterly CPU - Apr 2018 - Includes Oracle Apr 2018 CPU. IBM Cloud Manager with...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Manager with OpenStack

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6.0.16.20 and Version 7.0.9.31 these are used by IBM SmartCloud Entry of IBM Cloud Manager with OpenStack. These issues were disclosed as part of the IBM Java SDK updates in May 2016 and includes the...

Security Bulletin: OpenStack Cinder/Glance/Nova vulnerabilities affect IBM Cloud Manager with OpenStack (CVE-2015-5162)

Summary IBM Cloud Manager has addressed vulnerabilities in OpenStack Nova/Glance/Cinder. Vulnerability Details CVEID: CVE-2015-5162 DESCRIPTION: OpenStack Cinder, Glance and Nova are vulnerable to a denial of service, caused by the failure to limit qemu-img calls by the image parser. By using a...

Security Bulletin: OpenStack vulnerabilities affect IBM Cloud Manager with Openstack (CVE-2015-5163 CVE-2015-3241 CVE-2015-5223)

Summary IBM Cloud Manager with Openstack is vulnerable to several Openstack vulerabilities, which allow remote attackers exploit these vulnerabilitise to obtain sensitive information or cause a denial of service. Vulnerability Details CVEID: CVE-2015-3241 DESCRIPTION: OpenStack Nova is vulnerable...

Security Bulletin: RabbitMQ vulnerability affect IBM Cloud Manager with OpenStack (CVE-2015-8786)

Summary IBM Cloud Manager has addressed vulnerability in RabbitMQ. Vulnerability Details CVE-ID: CVE-2015-8786 DESCRIPTION: RabbitMQ is vulnerable to a denial of service, caused by an error in the Management plugin. By sending a specially crafted request, a remote authenticated attacker could...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Manager with OpenStack

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.15 used by IBM Cloud Manager with OpenStack. These issues were disclosed as part of IBM SDK, Java Technology Edition Quarterly CPU - Jan 2018 - Includes Oracle Jan 2018 CPU. / br / br IBM Cloud Manager...

Security Bulletin: A security vulnerability has been identified in paramiko shipped with IBM Cloud Manager with OpenStack (CVE-2018-7750)

Summary Paramiko is shipped as a component of IBM Cloud Manager with Openstack. This vulnerability cannot be exploited as IBM Cloud Manager with OpenStack only uses Paramiko client. Information about a security vulnerability affecting Paramiko has been published in a security bulletin...

Security Bulletin: Apache Xerces-C vulnerabilities (XML4C) affects IBM Cloud Manager with OpenStack (CVE-2016-0729)

Summary IBM Cloud Manager with Openstack is vulnerable to a Apache Xerces-C XML Parser library vulnerablities. Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during processing and error reporting. By sending specially crafted input...

Security Bulletin: Apache Xerces-C vulnerabilities affects IBM Cloud Manager with OpenStack (CVE-2016-4463)

Summary IBM Cloud Manager with Openstack is vulnerable to a Apache Xerces-C XML Parser library vulnerablities. Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing a deeply nested DTD. A remote attacker could exploit this...

Security Bulletin: OpenStack vulnerabilities affect IBM Cloud Manager with Openstack (CVE-2015-7548, CVE-2015-8749 CVE-2015-1850)

Summary IBM Cloud Manager with Openstack is vulnerable to several Openstack Nova vulerabilities, which could allow a local authenticated attacker or a remote attacker to obtain sensitive information Vulnerability Details CVEID: CVE-2015-8749 DESCRIPTION: OpenStack Nova could allow a remote attack...

Security Bulletin: OpenStack Heat vulnerability affect IBM Cloud Manager with OpenStack (CVE-2016-9185)

Summary IBM Cloud Manager has addressed a vulnerability in OpenStack Heat. Vulnerability Details CVE-ID: CVE-2016-9185 DESCRIPTION: OpenStack Heat could allow a remote authenticated attacker to obtain sensitive information. By using a special-crafted URL, a remote attacker could exploit this...

Security Bulletin: Vulnerability in SSLv3 affects IBM Cloud Manager with OpenStack (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SmartCloud Entry. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...