Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-neutron) security update

An update for openstack-neutron is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-1690

An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack RHOSP containers could send messages to the dbus. With access to the dbus, t...

CVE-2020-1690

openstack-selinux contains an improper authorization flaw in its applied policy that allows a non-root user in a container to escalate privileges by interacting with dbus, potentially starting/stopping services and causing denial of service. Affected are versions before openstack-selinux 0.8.24. ...

PT-2021-10076

Name of the Vulnerable Software and Affected Versions: openstack-selinux versions prior to 0.8.24 Description: An improper authorization flaw was discovered in openstack-selinux's applied policy, allowing a non-root user in a container to escalate privileges. A non-root attacker in one or more Re...

CVE-2020-1690: Improper Authorization

An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack RHOSP containers could send messages to the dbus. With access to the dbus, t...

RHEL 8 : Red Hat OpenStack Platform 16.1.6 (tripleo-ansible) (RHSA-2021:2119)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:2119 advisory. Ansible project for TripleO. Security Fixes: ansible.log file is visible to unprivileged users CVE-2021-31918 For more details about the security...

RHEL 8 : Red Hat OpenStack Platform 16.1.6 (python-httplib2) (RHSA-2021:2116)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2116 advisory. A comprehensive HTTP client library that supports many features left out of other HTTP libraries. Security Fixes: CRLF injection via an...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (python-httplib2) security update

An update for python-httplib2 is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2021-31918

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality...

Design/Logic Flaw

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-31918

CVE-2021-31918 affects tripleo-ansible as shipped in Red Hat OpenStack Platform 16.1.6. The Ansible log file is readable by unprivileged users during stack update and creation, creating a data confidentiality risk. Red Hat RHSA-2021:2119 documents this issue and provides remediation guidance via ...

CVE-2021-31918: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.4 (etcd) security update

An update for etcd is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RHEL 8 : Red Hat OpenStack Platform 16.1.4 (python-django) (RHSA-2021:0915)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0915 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as...

RHEL 8 : Red Hat OpenStack Platform 16.1.4 (etcd) (RHSA-2021:0916)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0916 advisory. A highly-available key value store for shared configuration. Security Fixes: large slice causes panic in decodeRecord method CVE-2020-15106...

Lxml Cross-Site Scripting Vulnerability

Lxml is a software from the individual developer of Lxml that interacts with Python to locate elements in Html. Lxml suffers from a cross-site scripting vulnerability that arises from javascript escaping via a combination of noscript and style. The following products and versions are affected:...

CVE-2020-10731

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

Design/Logic Flaw

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

CVE-2020-10731

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

CVE-2020-10731

Summary: CVE-2020-10731 affects the nova_libvirt container in Red Hat OpenStack Platform 16, where SELinux is not enabled, which disables sVirt isolation for running VMs. The issue is described across multiple sources as eliminating sVirt protection due to disabled SELinux. Public technical detai...