Security Bulletin: PowerVC is impacted by an OpenStack Neutron denial of service vulnerability (CVE-2018-14635)

Summary Openstack Neutron is vulnerable to a denial of service, caused by improper validation of user-supplied input. By using specially-crafted content, a remote authenticated attacker could exploit this vulnerability to cause the application to crash. Vulnerability Details CVEID: CVE-2018-14635...

Security Bulletin: PowerVC is affected by an Openstack Keystone vulnerability that could allow a remote authenticated attacker to discover restricted projects (CVE-2018-14432)

Summary PowerVC has addressed the following vulnerability. An authenticated "GET /v3/OS-FEDERATION/projects" request to the identity API may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects ...

Security Bulletin: A security vulnerability has been identified in IBM Spectrum Scale bundled with IBM Cloud PowerVC Manager for Software Defined Infrastructure (CVE-2018-1782)

Summary IBM Spectrum Scale v5.0.0 bundled with IBM Cloud PowerVC Manager for Software Defined Infrastructure SDI v1.1.0 can be upgraded to v5.0.1.X. IBM Spectrum Scale v5.0.1 is bundled with IBM Cloud PowerVC Manager for Software Defined Infrastructure SDI v1.1.1. Information about a security...

Security Bulletin: Ceilometer database access unrestricted in PowerVC (CVE-2015-1937)

Summary IBM PowerVC is using a ceilometer database that does not have authentication enabled. Vulnerability Details CVEID: CVE-2015-1937 DESCRIPTION: IBM PowerVC NoSQL database used by ceilometer is listening on the remote port and is configured to allow connections without any authentication. A...

Security Bulletin: Security vulnerabilities have been identified in IBM Spectrum Scale v5.0.0 shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure (SDI) v1.1.0 (CVE-2018-1431, CVE-2016-0705, CVE-2017-3732, CVE-2018-1447)

Summary IBM Spectrum Scale v5.0.0 is shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure SDI v1.1.0. Information about security vulnerabilities affecting IBM Spectrum Scale v5.0.0 have been published in a security bulletin. Vulnerability Details Refer to the security bullet...

Security Bulletin: Security vulnerabilities have been identified in IBM Spectrum Scale v5.0.0 shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure (SDI) v1.1.0 (CVE-2017-14746, CVE-2017-15275)

Summary IBM Spectrum Scale v5.0.0 is shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure SDI v1.1.0. Information about security vulnerabilities affecting IBM Spectrum Scale v5.0.0 have been published in a security bulletin. Vulnerability Details Refer to the security bullet...

Security Bulletin: A Security Vulnerability has Been Identified in IBM Spectrum Scale v5.0.0 shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure (SDI) v1.1.0 (CVE-2017-1654)

Summary IBM Spectrum Scale v5.0.0 is shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure SDI v1.1.0. Information about a security vulnerability affecting IBM Spectrum Scale v5.0.0 has been published in a security bulletin. Vulnerability Details Refer to the security bulleti...

Security Bulletin: Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)

Summary OpenStack Nova could allow a remote authenticated attacker to bypass security restrictions. By rebuilding an instance, an attacker could exploit this vulnerability to achieve Filter Scheduler bypass. Vulnerability Details CVE-ID: CVE-2017-16239 Description: OpenStack Nova could allow a...

Security Bulletin: IBM PowerVC is impacted by OpenStack Compute denial of service vulnerability (CVE-2016-7498)

Summary If an authenticated user deletes an instance while it is in resize state, it will cause the original instance to not be deleted from the compute node it was running on. An attacker can use this to launch a denial of service attack. All Nova setups are affected. Vulnerability Details CVEID...

Security Bulletin: IBM PowerVC is impacted by OpenStack Glance server-side request forgery (CVE-2017-7200)

Summary IBM PowerVC may disclose some sensitive information while creating images with 'copyfrom' feature in the v1 Image Service API. Vulnerability Details CVEID: CVE-2017-7200 DESCRIPTION: OpenStack Glance is vulnerable to server-side request forgery, caused by a flaw in the 'copyfrom' feature ...

Security Bulletin: IBM PowerVC is impacted by python oslo.middleware package information disclosure (CVE-2017-2592)

Summary IBM PowerVC may disclose some sensitive values in an error message. Vulnerability Details CVEID: CVE-2017-2592 DESCRIPTION: The OpenStack python oslo.middleware package could allow a local authenticated attacker to obtain sensitive information by including sensitive data in the CatchError...

Security Bulletin: IBM PowerVC is affected by vulnerability in OpenStack Nova (CVE-2017-7214)

Summary OpenStack Nova could allow an attacker to obtain sensitive information from logs. Vulnerability Details CVEID: CVE-2017-7214 DESCRIPTION: Legacy notification exception contexts appearing in OpenStack Nova's ERROR level logs may include sensitive information such as account passwords and...

Security Bulletin: IBM PowerVC - Local escalation of privilege vulnerability in DB2 for Linux (CVE-2016-5995)

Summary IBM PowerVC is impacted by Local escalation of privilege vulnerability in DB2 for Linux CVE-2016-5995 Vulnerability Details CVE-ID: CVE-2016-5995 Description: DB2 for Linux, Unix and Windows is vulnerable to a privilege escalation due to code being built with binaries with libraries in...

Security Bulletin: IBM PowerVC is impacted by OpenStack Nova information disclosure vulnerabilities (CVE-2015-1850, CVE-2015-7548)

Summary IBM PowerVC is impacted by OpenStack Nova information disclosure vulnerailities CVE-2015-1850, CVE-2015-7548 Vulnerability Details CVEID: CVE-2015-1850 DESCRIPTION: OpenStack Nova could allow a local attacker to obtain sensitive information, caused by the failure to provide input format t...

IBM PowerVC Information Disclosure Vulnerability (CNVD-2016-05956)

IBM PowerVC is a suite of virtualization management solutions. IBM PowerVC is affected by the OpenStack Nova information disclosure vulnerability. A local attacker can exploit the vulnerability to read arbitrary files from the host via qcow2 support for file overwrite image conversion...

Authentication flaw

IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code...

CVE-2015-1950

IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code...

CVE-2015-1950

IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code...

CVE-2015-1950

CVE-2015-1950 affects IBM PowerVC Standard Edition 1.2.2.1–1.2.2.2, where access to the Python interpreter with nova credentials is not authenticated. This allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code. The vu...

CVE-2015-1950: Undefined Security Weakness

IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code...