197 matches found
GHSA-8988-9CW3-XX77 vulnerabilities
Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...
CVE-2026-97689 vulnerabilities
Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...
GHSA-GH4C-6FX4-QH6G vulnerabilities
Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...
GHSA-VXQ7-64XX-V4GW vulnerabilities
Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Octavia vulnerabilities (USN-8814-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8814-1 advisory. It was discovered that Octavia did not properly validate TLS cipher string fields in the Amphora provider driver. An authenticate...
USN-8814-1 octavia vulnerabilities
It was discovered that Octavia did not properly validate TLS cipher string fields in the Amphora provider driver. An authenticated attacker who owns a TLS-enabled load balancer could possibly use this issue to inject arbitrary HAProxy configuration directives. CVE-2026-94572 It was discovered tha...
USN-8814-1: Octavia vulnerabilities
It was discovered that Octavia did not properly validate TLS cipher string fields in the Amphora provider driver. An authenticated attacker who owns a TLS-enabled load balancer could possibly use this issue to inject arbitrary HAProxy configuration directives. CVE-2026-94572 It was discovered tha...
CVE-2026-94571
A flaw was found in OpenStack Octavia. An authenticated user who can create or update L7 policies on their own load balancer can inject arbitrary HAProxy configuration directives through the redirecturl or redirectprefix fields. The URL validator does not reject control characters such as tabs an...
CVE-2026-94572
A flaw was found in OpenStack Octavia. The tlsciphers field on listeners and pools does not reject control characters or spaces. An authenticated project member can embed extra text in that field so that HAProxy treats it as additional configuration rather than a cipher list. This can change...
Linux Distros Unpatched Vulnerability : CVE-2026-94572
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is...
Linux Distros Unpatched Vulnerability : CVE-2026-94571
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RF...
CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...
DEBIAN-CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...
DEBIAN-CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...
CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...
CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...
UBUNTU-CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...
UBUNTU-CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...
CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...
a10-octavia (2.2.0) potentially affected by CVE-2026-94572 via octavia (10.0.0)
octavia PYPI version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on octavia and may be impacted: - a10-octavia 2.2.0 Source cves: CVE-2026-94572 Source advisory: MEND:CVE-2026-94572...