keystone/fuzz_asm_hex: Use-of-uninitialized-value in llvm_ks::HexagonMCCodeEmitter::getExprOpValue

Detailed report: https://oss-fuzz.com/testcase?key=5664745516957696 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmhex Fuzz target binary: fuzzasmhex Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone/fuzz_asm_sparc64be: Bad-free in llvm_ks::MCEncodedFragmentWithFixups<32u, 4u>::~MCEncodedFragmentWithFixups

Project: https://github.com/keystone-engine/keystone.git Detailed report: https://oss-fuzz.com/testcase?key=5745963403051008 Project: keystone Fuzzer: aflkeystonefuzzasmsparc64be Fuzz target binary: fuzzasmsparc64be Job Type: aflasankeystone Platform Id: linux Crash Type: Bad-free Crash Address:...

keystone/fuzz_asm_x86_64: Use-of-uninitialized-value in X86AsmParser::ParseIntelOperand

Detailed report: https://oss-fuzz.com/testcase?key=5742603060903936 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8664 Fuzz target binary: fuzzasmx8664 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone/fuzz_asm_arm_thumb: Use-of-uninitialized-value in llvm_ks::ARMAsmBackend::applyFixup

Detailed report: https://oss-fuzz.com/testcase?key=5640810557603840 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmarmthumb Fuzz target binary: fuzzasmarmthumb Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone/fuzz_asm_arm_thumbbe: Bad-cast to const llvm_ks::MCSectionELF from llvm_ks::MCSectionMachO in llvm_ks::MCELFStreamer::ChangeSection

Detailed report: https://oss-fuzz.com/testcase?key=5757565082796032 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmarmthumbbe Fuzz target binary: fuzzasmarmthumbbe Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000050dee30 Crash State: Bad-cast to...

keystone/fuzz_asm_x86_16: Heap-use-after-free in llvm_ks::X86Operand::getToken

Detailed report: https://oss-fuzz.com/testcase?key=5740417828519936 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8616 Fuzz target binary: fuzzasmx8616 Job Type: libfuzzerasankeystone Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60d0000003a8 Crash State:...

keystone/fuzz_asm_arm_armbe: Use-of-uninitialized-value in llvm_ks::APFloat::isFinite

Detailed report: https://oss-fuzz.com/testcase?key=5695402544726016 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmarmarmbe Fuzz target binary: fuzzasmarmarmbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone/fuzz_asm_mipsbe: Use-of-uninitialized-value in llvm_ks::AsmLexer::LexDigit

Project: https://github.com/keystone-engine/keystone.git Detailed report: https://oss-fuzz.com/testcase?key=5695573806546944 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmmipsbe Fuzz target binary: fuzzasmmipsbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type:...

openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects

A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is...

Important: Red Hat Security Advisory: openstack-keystone security update

An update for openstack-keystone is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects

A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is...

Important: Red Hat Security Advisory: openstack-keystone security update

An update for openstack-keystone is now available for Red Hat OpenStack Platform 13.0 Queens. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

openstack-keystone: Information Exposure through /v3/OS-FEDERATION/projects

A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is...

Debian DSA-4275-1 : keystone - security update

Kristi Nikolla discovered an information leak in Keystone, the OpenStack identity service, if running in a federated setup. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4275. The text itself is copyright C...

[SECURITY] [DSA 4275-1] keystone security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4275-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 16, 2018 https://www.debian.org/security/faq -...

DSA-4275-1 keystone - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4275-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-14432

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all...

CVE-2018-14432

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all...

Cross site request forgery (csrf)

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all...