openstack-tripleo-heat-templates: unsafe pipeline ordering of swift staticweb middleware

A flaw was discovered in the pipeline ordering of OpenStack Object Storage's staticweb middleware in the swiftproxy configuration generated from the openstack-tripleo-heat-templates package OpenStack director. The staticweb middleware was incorrectly configured before the Identity Service, and...

RHEL 6 : Red Hat Gluster Storage 3.1 update (Moderate) (RHSA-2015:1845)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1845 advisory. Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It...

Swift: unauthorized deletion of versioned Swift object

A flaw was found in OpenStack Object Storage that could allow an authenticated user to delete the most recent version of a versioned object regardless of ownership. To exploit this flaw, an attacker must know the name of the object and have listing access to the x-versions-location container...

swiftonfile: gluster-swift metadata constraints are not correctly enforced

A flaw was found in the metadata constraints in Red Hat Gluster Storage's OpenStack Object Storage swiftonfile. By adding metadata in several separate calls, a malicious user could bypass the maxmetacount constraint, and store more metadata than allowed by the configuration...

Moderate: Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update

Red Hat Gluster Storage 3.1 Update 1, which fixes one security issue, several bugs, and adds various enhancements, is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

Swift: unauthorized deletion of versioned Swift object

A flaw was found in OpenStack Object Storage that could allow an authenticated user to delete the most recent version of a versioned object regardless of ownership. To exploit this flaw, an attacker must know the name of the object and have listing access to the x-versions-location container...

Moderate: Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update

Red Hat Gluster Storage 3.1 Update 1, which fixes one security issue, several bugs, and adds various enhancements, is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

Low: Red Hat Security Advisory: mod_proxy_fcgi and ceph security and bug fix update

Updated modproxyfcgi and ceph packages that fix one security issue and several bugs are now available for CentOS 6. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

OpenStack Nova Denial of Service Vulnerability (CNVD-2015-06392)

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration and Rackspace, Inc. in the U.S. OpenStack Nova is one of the cloud computing construct controllers written in Python. It is part of the IaaS system. A denial of service vulnerability...

OpenStack Neutron Firewall Security Bypass Vulnerability

OpenStack is a cloud platform management project. neutron is one of the networking components that provides network-as-a-service, enabling the creation of networks between OpenStack services, access to network devices into the mesh, and more. A security bypass vulnerability exists in Neutron,...

SUSE-SU-2015:1666-1 Security update for Cloud Compute 12

This collective update for the Cloud Compute 12 Module provides several fixes and enhancements. openstack-suse: - Do not copy upstream Python requirements to the package. bsc920573 openstack-nova: - Fix metadata not returning just instance private IP. bsc934523 - Enable tenant/user specific...

CVE-2015-5251

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/...

UBUNTU-CVE-2015-5251

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/...

PT-2015-6817

Name of the Vulnerable Software and Affected Versions OpenStack Image Service Glance versions prior to 2014.2.4 juno OpenStack Image Service Glance versions 2015.1.x prior to 2015.1.2 kilo Description The issue allows remote authenticated users to bypass access restrictions and change the status ...

CVE-2013-0270

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service CPU and memory consumption via a large HTTP request, as demonstrated by a long tenantname when requesting a token...

CVE-2013-0266

manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the 1 cinder.conf and 2 api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files...

Red Hat Enterprise Linux OpenStack Platform Stack Buffer Overflow Vulnerability

Red Hat Enterprise Linux OpenStack Platform is an enterprise-class solution. A stack buffer overflow vulnerability exists in Red Hat Enterprise Linux OpenStack Platform. An attacker exploiting this vulnerability could cause a denial of service corrupt heap memory and QEMU crash...

SUSE-RU-2015:1730-1 Recommended update for various Crowbar barclamps and OpenStack components

This update provides fixes and enhancements for various Crowbar barclamps and OpenStack components. crowbar-barclamp-ceilometer: - Do not assume ceilometer-agent-hyperv is listed in elements. bsc937117 crowbar-barclamp-cinder: - Fix hideShow toggle of passwordfield in backends. bsc919963...

Moderate: Red Hat Bug Fix Advisory: Red Hat Enterprise Linux OpenStack Platform Bug Fix and Enhancement Advisory

Updated mariadb-galera, rabbitmq-server, openvswitch, openstack-selinux, openstack-trove, sos-plugins-openstack, and python-eventlet packages that resolve various issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 Icehouse for RHEL 7. Red Hat Enterprise Linux OpenStack...

Moderate: Red Hat Bug Fix Advisory: Red Hat Enterprise Linux OpenStack Platform Bug Fix and Enhancement Advisory

Updated mariadb-galera and python-eventlet packages that resolve various issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 Icehouse for RHEL 6. Red Hat Enterprise Linux OpenStack Platform provides the facilities for building a private or public infrastructure-as-a-servi...