Important: Red Hat Security Advisory: puppet-tripleo security update

An update for puppet-tripleo is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

puppet-tripleo: if ssl is enabled, traffic is open on both undercloud and overcloud

An access-control flaw was discovered in puppet-tripleo's IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. Some API services in Red Hat OpenStack Platform director are not exposed to public networks, which meant their $publicsslport value was set to...

CVE-2016-9599

puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could use these open ports to gain access to unauthorized resources...

TripleO Heat templates Information Disclosure Vulnerability

TripleO Heat templates tripleo-heat-templates is a set of tools for describing samples of multi-host infrastructure. An information disclosure vulnerability exists in TripleO Heat templates tripleo-heat-templates, which can be exploited by a remote attacker to obtain sensitive information in...

Information disclosure

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

PYSEC-2016-34

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

CVE-2015-5271

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

CVE-2015-5271

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

UBUNTU-CVE-2015-5271

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

CVE-2015-5271

CVE-2015-5271 affects TripleO Heat templates: the swiftproxy pipeline does not properly order Keystone before Swift staticweb middleware when staticweb is enabled, potentially allowing remote attackers to obtain sensitive information from private containers via unspecified vectors. This is docume...

CVE-2015-5271

The TripleO Heat templates tripleo-heat-templates do not properly order the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive...

PT-2016-3678 · Openstack · Tripleo-Heat-Templates

Name of the Vulnerable Software and Affected Versions: tripleo-heat-templates affected versions not specified Description: The issue is related to the improper ordering of the Identity Service keystone before the OpenStack Object Storage Swift staticweb middleware in the swiftproxy pipeline when...

TripleO Heat templates design flaw

TripleO Heat templates tripleo-heat-templates is a set of tools for describing samples of multi-host infrastructure. A security vulnerability exists in TripleO Heat templates. When the program is deployed using the command line interface, a remote attacker can exploit this vulnerability to forge...

Red Hat Enterprise Linux OpenStack Platform Information Disclosure Vulnerability

Red Hat Enterprise Linux OpenStack Platform is an open source IaaS Infrastructure-as-a-Service solution from Red Hat, Inc. The solution supports the creation and management of private, public, and hybrid clouds.TripleO Heat templates tripleo-heat-templates is a set of tools for describing a sampl...

CVE-2015-5329

The TripleO Heat templates tripleo-heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which makes it easier for remote attackers to obtain access to services in deployed overclouds by leveraging knowledge of the...

CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

UBUNTU-CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

Code injection

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

PYSEC-2016-35

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...