CVE-2017-15139

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive...

CVE-2017-15139

CVE-2017-15139 affects OpenStack Cinder up to Queens, specifically ScaleIO volumes using thin volumes with zero padding. The vulnerability can lead to leakage of sensitive data between tenants when new volumes are created in certain configurations. Public documentation in connected items confirms...

PT-2018-5782 · Openstack · Openstack Cinder

Name of the Vulnerable Software and Affected Versions: openstack-cinder versions up to and including Queens Description: A vulnerability was found in openstack-cinder, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO...

openstack-nova: Swapping encrypted volumes can allow an attacker to corrupt the LUKS header causing a denial of service in the host

OpenStack Nova has a vulnerability in the handling of encrypted volumes. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. All Nova installations supporting...

Moderate: Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update

An update for openstack-nova is now available for Red Hat OpenStack Platform 12.0 Pike. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

VMWare VVOL Support With Citrix MCS and PVS

Use of VMware vSphere Virtual Volumes VMware vVOLs with CVAD MCS and PVS environments...

CVE-2017-7497

The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...

Spoofing

The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...

CVE-2017-7497

The dialog for creating cloud volumes cinder provider in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant...

CVE-2017-7497

CVE-2017-7497 affects Red Hat CloudForms (CloudForms Management Engine) where the dialog for creating cloud volumes (cinder provider) fails to filter cloud tenants by user. The underlying issue allows an attacker who can create storage volumes to allocate volumes for other tenants, enabling unaut...

CVE-2018-14611

An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in trymergefreespace when mounting a crafted btrfs image, because of a lack of chunk type flag checks in btrfscheckchunkvalid in fs/btrfs/volumes.c...

PT-2018-8390 · Red Hat · Cloudforms

Name of the Vulnerable Software and Affected Versions: CloudForms affected versions not specified Description: The issue concerns the dialog for creating cloud volumes in CloudForms, specifically with the cinder provider, where it fails to filter cloud tenants by user. This allows an attacker, wh...

Backup Copy or Replication job using WAN accelerators fails with "Source WAN accelerator error: Failed to decompress LZ4 block"

Challenge A Backup Copy or Replication job that uses WAN accelerator fails with any of the following errors: Error: Source WAN accelerator error: Failed to decompress LZ4 block: Bad crc Error: Source WAN accelerator error: Failed to decompress LZ4 block: Incorrect decompression result or length...

CVE-2018-10841

glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool,...

CVE-2018-10841

glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool,...

SUSE-SU-2018:1448-1 Security update for openstack-nova

This update for openstack-nova fixes the following bugs and security issues: The following security-issue has been fixed: - CVE-2017-18191: libvirt: Block swap volume attempts with encrypted volumes. bsc1081685 Additionally, the following bugs have been fixed: - Set TasksMax to infinity for...

Unauthorized Access To Storage Volumes

libglusterfs.so is vulnerable to unauthorized access to storage volumes. The vulnerability exists due to the fix introduced for CVE-2018-1112, allowing unauthenticated users to mount the storage volumes...

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

It was found that fix for CVE-2018-1088 introduced a new vulnerability in the way 'auth.allow' is implemented in glusterfs server. An unauthenticated gluster client could mount gluster storage volumes...

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

It was found that fix for CVE-2018-1088 introduced a new vulnerability in the way 'auth.allow' is implemented in glusterfs server. An unauthenticated gluster client could mount gluster storage volumes...

CVE-2018-1112

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression...