OP
Product
Openstack
209
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 57Medium 87Low 7
Watch
Add Openstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-2637 | 10.0 | Jul 26 | A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration Affected: 7.0; 8; 9; 10 |
| CVE-2016-9603 | 9.9 | Jul 27 | A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update… Affected: 5.0; 6.0; 7.0; 8; 9; 10 |
| CVE-2017-2620 | 9.9 | Jul 27 | Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue Affected: 5.0; 6.0; 7.0; 8; 9; 10 |
| CVE-2015-5741 | 9.8 | Feb 8 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… Affected: 7.0; 8 |
| CVE-2013-2167 | 9.8 | Dec 10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass Affected: 3.0 |
| CVE-2013-2166 | 9.8 | Dec 10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass Affected: 3.0 |
| CVE-2018-17963 | 9.8 | Oct 9 | qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other… Affected: 10; 13; 14 |
| CVE-2018-14620 | 9.8 | Sep 10 | The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage Affected: 12; 13 |
| CVE-2017-7481 | 9.8 | Jul 19 | Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe Affected: 10; 11 |
| CVE-2018-11219 | 9.8 | Jun 17 | An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of… Affected: 10; 13 |
| CVE-2018-11218 | 9.8 | Jun 17 | Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer… Affected: 10; 13 |
| CVE-2017-10906 | 9.8 | Dec 8 | Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via… Affected: 13 |
| CVE-2017-9214 | 9.8 | May 23 | In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2014-5009 | 9.8 | Mar 31 | Snoopy allows remote attackers to execute arbitrary commands Affected: 5.0; 6.0 |
| CVE-2014-5008 | 9.8 | Mar 31 | Snoopy allows remote attackers to execute arbitrary commands Affected: 5.0; 6.0 |
| CVE-2008-7313 | 9.8 | Mar 31 | The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands Affected: 5.0; 6.0 |
| CVE-2016-6662 | 9.8 | Sep 20 | Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before… Affected: 5.0; 6.0; 7.0; 8; 9 |
| CVE-2019-14859 | 9.1 | Jan 2 | A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding Affected: 10; 13; 14; 15 |
| CVE-2019-10141 | 9.1 | Jul 30 | A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1 Affected: 10; 13; 14; 9 |
| CVE-2017-2615 | 9.1 | Jul 3 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue Affected: 5.0; 6.0; 7.0; 8; 9; 10 |
| CVE-2015-7512 | 9.0 | Jan 8 | Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash)… Affected: 5.0 |
| CVE-2022-38065 | 8.8 | Dec 21 | A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior Affected: All versions, or not specified |
| CVE-2021-3656 | 8.8 | Mar 4 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization Affected: 13 |
| CVE-2018-10899 | 8.8 | Aug 1 | A flaw was found in Jolokia versions from 1.2 to before 1.6.1 Affected: 13 |
| CVE-2018-10898 | 8.8 | Jul 30 | A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40 Affected: 13 |
| CVE-2016-4474 | 8.8 | Jun 30 | The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka… Affected: 7.0; 8 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: 5.0; 6.0; 7.0; 8 |
| CVE-2016-1568 | 8.8 | Apr 12 | Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly… Affected: 6.0; 7.0; 5.0 |
| CVE-2016-2857 | 8.4 | Apr 12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length… Affected: 5.0; 5.0; 6.0; 7.0; 8; 9 |
| CVE-2019-16789 | 8.2 | Dec 26 | In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed… Affected: 15 |
| CVE-2017-2627 | 8.2 | Aug 22 | A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11 Affected: 10; 11 |
| CVE-2018-11806 | 8.2 | Jun 13 | m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams Affected: 8; 9; 10; 12; 13 |
| CVE-2020-25717 | 8.1 | Feb 18 | A flaw was found in the way Samba maps domain users to local users Affected: 13; 16.1; 16.2 |
| CVE-2018-1000807 | 8.1 | Oct 8 | Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free… Affected: 13 |
| CVE-2016-9587 | 8.1 | Apr 24 | Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems Affected: 11 |
| CVE-2016-1714 | 8.1 | Apr 7 | The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS… Affected: 5.0 |
| CVE-2019-3895 | 8.0 | Jun 3 | An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director Affected: 12 |
| CVE-2017-7466 | 8.0 | Jun 22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems Affected: 10; 11 |
| CVE-2019-14846 | 7.8 | Oct 8 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of… Affected: 13 |
| CVE-2019-3830 | 7.8 | Mar 26 | A vulnerability was found in ceilometer before version 12.0.0.0rc1 Affected: 10 |
| CVE-2018-10875 | 7.8 | Jul 13 | A flaw was found in ansible Affected: 10; 12; 13 |
| CVE-2018-10874 | 7.8 | Jul 2 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run… Affected: 10; 12; 13 |
| CVE-2017-7980 | 7.8 | Jul 25 | Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of… Affected: 6.0; 7.0; 8; 9; 10; 5.0; +1 more |
| CVE-2016-5126 | 7.8 | Jun 1 | Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly… Affected: 6.0; 7.0; 8; 9; 5.0 |
| CVE-2018-2755 | 7.7 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication) Affected: 12 |
| CVE-2021-31918 | 7.5 | May 6 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1 Affected: 16.1 |
| CVE-2020-27827 | 7.5 | Mar 18 | A flaw was found in multiple versions of OpenvSwitch Affected: 10; 13 |
| CVE-2020-9490 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 Affected: 16.1 |
| CVE-2012-6685 | 7.5 | Feb 19 | Nokogiri before 1.5.4 is vulnerable to XXE attacks Affected: 4.0; 6.0 |
| CVE-2019-16786 | 7.5 | Dec 20 | Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the… Affected: 15 |