CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2023-48795

CVE-2023-48795 is referenced across several connected advisories, detailing affected packages and required upgrades. Astra Linux/CBL-Mariner entries note: podman (<5.6.1-2) needs upgrade, erlang (<25.2-1), libssh2 (<1.11.1-1), libssh (<0.10.6-1), terraform (<1.3.2-25), kubevirt (&l...

CVE-2023-1108

CVE-2023-1108 affects Undertow within Red Hat JBoss EAP 7.3.x (SSLConduit) where an infinite loop on close can cause DoS. Connected RHSA-2025-9583 confirms the issue and indicates a fix in the eap-7.3.z line (Patched Undertow). Remediation is to upgrade to the patched EAP 7.3.x release (eap-7.3.z...

CVE-2023-3354

CVE-2023-3354 affects the QEMU built-in VNC server. The issue arises from improper I/O watch removal during TLS handshake, which can lead to a NULL pointer dereference when a previously-handshake connection is cleaned up during new connections. This allows a remote unauthenticated attacker to cau...

CVE-2023-5625

CVE-2023-5625 describes a patch regression in Red Hat builds of python-eventlet where the CVE-2021-21419 fix was not applied across all builds/products. Connected sources confirm the issue affects python-eventlet and note a related memory-exhaustion risk via large or highly compressed websocket f...

CVE-2023-1668

CVE-2023-1668 — Open vSwitch (OVS) has a flaw where, when processing an IP packet with protocol 0, OVS installs a datapath flow whose action does not modify the IP header. This can cause a datapath rule matching all IP protocols (nw_proto wildcarded) to have an incorrect action, risking improper ...

CVE-2022-3100

The CVE-2022-3100 issue affects the openstack-barbican component and enables an access policy bypass via a query string when calling the API. This vulnerability is discussed across multiple sources, with explicit confirmation in the SUSE-SU-2023:0071-1 security update: openstack-barbican Fixes CV...

CVE-2022-3277

CVE-2022-3277 affects OpenStack Neutron; an uncontrolled resource consumption flaw allows a remote authenticated user to query security groups for an invalid project, creating resources unconstrained by quotas and potentially causing a denial of service. The issue is tied to the OpenStack Neutron...

CVE-2022-3596

CVE-2022-3596 affects OpenStack Platform’s undercloud (instack-undercloud) and is caused by an information disclosure where the rsync daemon can leak data to the undercloud. This unauthenticated, remote-access flaw may allow attackers to inspect sensitive data, including administrator credentials...

CVE-2023-1625

CVE-2023-1625 affects OpenStack Heat. A disclosed information leak allows a remote, authenticated attacker to use the stack show command to reveal otherwise hidden parameters. Impact is described as low for confidentiality and low for other aspects, with exploitation tied to OpenStack Heat behavi...

CVE-2023-3637

Summary: CVE-2023-3637 affects OpenStack Networking (neutron) within Red Hat OpenStack Platform. The flaw is an uncontrolled resource consumption vulnerability where a remote authenticated user can query a list of security groups for an invalid project, causing resources to be created and not con...

CVE-2023-1633

CVE-2023-1633 affects OpenStack Barbican. Multiple sources describe a credentials-leak flaw where a local authenticated attacker can read the Barbican configuration file and access sensitive credentials. The issue is tied to insecure configuration file handling and is acknowledged in Red Hat’s RH...

CVE-2023-1636

OpenStack Barbican containers in an all‑in‑one configuration share CGROUP, USER, and NET namespaces with the host and other services, allowing a compromised service to access data transmitted to/from Barbican. The CVE-2023-1636 entry describes an information‑disclosure risk due to incomplete cont...

CVE-2022-3261

CVE-2022-3261 affects OpenStack; multiple components log plaintext passwords to /var/log/messages during the OpenStack overcloud update, causing disclosure of sensitive information. The available sources describe the issue and its impact but do not specify affected versions, fixes, or mitigations...