CVE-2024-29156

A flaw was found in the Murano component of OpenStack. This vulnerability allows ordinary users capable of importing and deploying app packages to access sensitive information within OpenStack services. Specifically, through this exploit, unauthorized users can obtain Murano service account...

Openstack Oslo.privsep Privilege Escalation

The vulnerability of the Oslo.privsep component in the OpenStack cloud service platform is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

This Week in Spring - September 5th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? I just got back from another fabulous labor day weekend, and am headed to Oslo, Norway, for the fabulous JavaZone 2023 event. This will be my first time returning to lovely Oslo, Norway, since the pandemic! I can...

SUSE CVE-2013-6491

The python-qpid client common/rpc/implqpid.py in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpidprotocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network...

SUSE CVE-2014-4615

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry Ceilometer 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain XAUTHTOKEN values by reading the message queue...

SUSE CVE-2014-7231

The strutils.maskpassword function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log...

SUSE CVE-2017-2592

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component...

SUSE CVE-2022-0718

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote " in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext...

RHEL 8 : Red Hat OpenStack Platform 16.1.9 (python-oslo-utils) (RHSA-2022:8873)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8873 advisory. The OpenStack Oslo Utility library. Security Fixes: incorrect password masking in debug output CVE-2022-0718 For more details about the security...

CVE-2022-38065

A privilege escalation flaw was found in the oslo-privsep functionality in OpenStack. Overly permissive functionality in the tools leveraging this library within a container can lead to increased privileges...

DEBIAN-CVE-2022-38065

A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within a container can lead increased privileges...

PT-2022-7148 · Openstack +1 · Openstack +2

Name of the Vulnerable Software and Affected Versions: OpenStack versions prior to git master 05194e7618 Description: A privilege escalation issue exists in the oslo.privsep functionality of OpenStack. This is due to overly permissive functionality within tools that leverage this library within a...

OpenStack 安全漏洞

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. OpenStack suffers from a security vulnerability that stems from an elevation of privilege vulnerability in the oslo.privsep function, where over-licensed functions can lead to increased...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-oslo-utils) security update

An update for python-oslo-utils is now available for Red Hat OpenStack Platform 16.1.9 Train for Red Hat Enterprise Linux RHEL 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

python-oslo-utils: incorrect password masking in debug output

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote " in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext...

Debian dla-3106 : python-oslo.utils - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3106 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3106-1 [email protected] https://www.debian.org/lts/security/...

cloudmesh-client (>=4.5.0, <=4.7.3) potentially affected by CVE-2022-0718 via oslo-utils (3.22.0)

oslo-utils PYPI version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on oslo-utils and may be impacted: - cloudmesh-client =4.5.0, =4.7.3 Source cves: CVE-2022-0718 Source advisory: OSV:GHSA-WMQQ-R32M-87C5...

keystonemiddleware (>=1.5.2, <=1.5.3), networking-ofagent (>=2015.1.5, <=2015.1.6) +15 more potentially affected by CVE-2022-0718 via oslo-utils (1.4.2)

oslo-utils PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on oslo-utils and may be impacted: - keystonemiddleware =1.5.2, =2015.1.5, =1.8.1, =1.0.14, =1.1.2, =0.14.3, =0.10.0, =0.5.0, =1.3.2, =0.5.8, =2.23.2, =2.23.3 and more Source...

cloudmesh-client (>=4.3.2, <=4.4.0) potentially affected by CVE-2022-0718 via oslo-utils (3.15.0)

oslo-utils PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on oslo-utils and may be impacted: - cloudmesh-client =4.3.2, =4.4.0 Source cves: CVE-2022-0718 Source advisory: OSV:GHSA-WMQQ-R32M-87C5...

debtcollector (0.2.0) potentially affected by CVE-2022-0718 via oslo-utils (1.5.0)

oslo-utils PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on oslo-utils and may be impacted: - debtcollector 0.2.0 Source cves: CVE-2022-0718 Source advisory: OSV:GHSA-WMQQ-R32M-87C5...