Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.93547 · Published 2023-12-18 · Partial fix · 0.40.2, 0.17.0 +2 CWE-354
Priority HIGH 66
An information leak was discovered in OpenStack heat.
CVSS 3.1HIGH 7.4· Network · Low privileges · No interaction · EPSS 0.00715 · Published 2023-09-24 · Partial fix · 20.0.0 CWE-202
Priority MEDIUM 62
An uncontrolled resource consumption flaw was found in openstack-neutron.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01065 · Published 2023-03-06 · Partial fix · 19.5.0, 18.6.0 +1 CWE-400
Priority MEDIUM 49
A vulnerability was found in openstack-nova's console proxy, noVNC.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.26792 · Published 2022-03-02 · Partial fix · 21.2.3, 22.2.3 +1 CWE-601
Priority MEDIUM 44
A flaw was found in openvswitch (OVS).
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.01216 · Published 2023-04-10 · Partial fix CWE-670
Priority MEDIUM 44
A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00889 · Published 2020-07-31 · Fixed CWE-284
Priority MEDIUM 42
A permissive list of allowed inputs flaw was found in DPDK.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.02389 · Published 2022-08-31 · Partial fix CWE-791
Priority MEDIUM 41
A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0098 · Published 2023-11-01 · Fixed in 0.30.2-4.el9, 0.30.2-4.el8ost +1 CWE-770
Priority LOW 39
When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.01701 · Published 2017-11-27 · No fix listed CWE-295
Priority LOW 38
An authorization flaw was found in openstack-barbican.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0128 · Published 2022-09-06 · Partial fix · 14.0.0 CWE-863
Priority LOW 38
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "except…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02759 · Published 2021-03-23 · Partial fix · 2.7.4 CWE-835
Priority LOW 36
A flaw was found in the QEMU built-in VNC server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01606 · Published 2023-07-11 · Partial fix CWE-476
Priority LOW 36
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01771 · Published 2023-09-14 · Partial fix · 2.3.5, 2.2.24 +18 CWE-835
Priority LOW 36
A flaw was found in openstack-keystone.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01863 · Published 2022-08-26 · No fix listed CWE-863
Priority LOW 36
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01651 · Published 2020-11-12 · Partial fix · 4.7 CWE-385
Priority LOW 35
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00392 · Published 2024-08-21 · Partial fix · 15.4.1-17.1.20240911093743.e5b18f2.el8ost, 16.5.1-17.1.20240913093745.f3599d0.el8ost +2 CWE-295
Priority LOW 35
An information leak was found in OpenStack's undercloud.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01107 · Published 2023-09-20 · Fixed in 8.4.9-13.el7ost CWE-402
Priority LOW 33
A flaw was found in OpenStack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00292 · Published 2023-09-15 · No fix listed CWE-256
Priority LOW 33
A flaw was found in openstack-neutron's default Open vSwitch firewall rules.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.01043 · Published 2021-05-28 · Partial fix · 16.3.1, 15.3.3 +1 CWE-345
Priority LOW 31
An uncontrolled resource consumption flaw was found in openstack-neutron.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01305 · Published 2023-07-25 · Partial fix · 1:15.3.5-2.20230216175503.el8ost CWE-400
Priority LOW 31
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00295 · Published 2020-12-18 · Partial fix CWE-522
Priority LOW 31
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00233 · Published 2020-09-23 · Partial fix · 2.8.15, 2.9.13 CWE-347
Priority LOW 30
A flaw was found in Keystone.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00719 · Published 2022-09-01 · No fix listed CWE-324
Priority LOW 30
A key length flaw was found in Red Hat Ceph Storage.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00597 · Published 2022-08-25 · Partial fix CWE-327
Load more
THREATIST.IORead the docs