OP
Product
Openstack
209
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 57Medium 87Low 7
Watch
Add Openstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-38065 | 8.8 | Dec 21 | A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior Affected: All versions, or not specified |
| CVE-2021-3656 | 8.8 | Mar 4 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization Affected: 13 |
| CVE-2018-10899 | 8.8 | Aug 1 | A flaw was found in Jolokia versions from 1.2 to before 1.6.1 Affected: 13 |
| CVE-2018-10898 | 8.8 | Jul 30 | A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40 Affected: 13 |
| CVE-2016-4474 | 8.8 | Jun 30 | The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka… Affected: 7.0; 8 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: 5.0; 6.0; 7.0; 8 |
| CVE-2016-1568 | 8.8 | Apr 12 | Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly… Affected: 6.0; 7.0; 5.0 |
| CVE-2016-2857 | 8.4 | Apr 12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length… Affected: 5.0; 5.0; 6.0; 7.0; 8; 9 |
| CVE-2019-16789 | 8.2 | Dec 26 | In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed… Affected: 15 |
| CVE-2017-2627 | 8.2 | Aug 22 | A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11 Affected: 10; 11 |
| CVE-2018-11806 | 8.2 | Jun 13 | m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams Affected: 8; 9; 10; 12; 13 |
| CVE-2020-25717 | 8.1 | Feb 18 | A flaw was found in the way Samba maps domain users to local users Affected: 13; 16.1; 16.2 |
| CVE-2018-1000807 | 8.1 | Oct 8 | Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free… Affected: 13 |
| CVE-2016-9587 | 8.1 | Apr 24 | Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems Affected: 11 |
| CVE-2016-1714 | 8.1 | Apr 7 | The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS… Affected: 5.0 |
| CVE-2019-3895 | 8.0 | Jun 3 | An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director Affected: 12 |
| CVE-2017-7466 | 8.0 | Jun 22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems Affected: 10; 11 |
| CVE-2019-14846 | 7.8 | Oct 8 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of… Affected: 13 |
| CVE-2019-3830 | 7.8 | Mar 26 | A vulnerability was found in ceilometer before version 12.0.0.0rc1 Affected: 10 |
| CVE-2018-10875 | 7.8 | Jul 13 | A flaw was found in ansible Affected: 10; 12; 13 |
| CVE-2018-10874 | 7.8 | Jul 2 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run… Affected: 10; 12; 13 |
| CVE-2017-7980 | 7.8 | Jul 25 | Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of… Affected: 6.0; 7.0; 8; 9; 10; 5.0; +1 more |
| CVE-2016-5126 | 7.8 | Jun 1 | Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly… Affected: 6.0; 7.0; 8; 9; 5.0 |
| CVE-2018-2755 | 7.7 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication) Affected: 12 |
| CVE-2021-31918 | 7.5 | May 6 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1 Affected: 16.1 |
| CVE-2020-27827 | 7.5 | Mar 18 | A flaw was found in multiple versions of OpenvSwitch Affected: 10; 13 |
| CVE-2020-9490 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 Affected: 16.1 |
| CVE-2012-6685 | 7.5 | Feb 19 | Nokogiri before 1.5.4 is vulnerable to XXE attacks Affected: 4.0; 6.0 |
| CVE-2019-16786 | 7.5 | Dec 20 | Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the… Affected: 15 |
| CVE-2019-16785 | 7.5 | Dec 20 | Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a… Affected: 15 |
| CVE-2013-1793 | 7.5 | Dec 10 | openstack-utils openstack-db has insecure password creation Affected: 2.1; 3.0; 4.0 |
| CVE-2019-11287 | 7.5 | Nov 23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4,… Affected: 15 |
| CVE-2019-14818 | 7.5 | Nov 14 | A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with… Affected: 10 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 14 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 14 |
| CVE-2018-16856 | 7.5 | Mar 26 | In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log… Affected: 12; 13; 14 |
| CVE-2018-17205 | 7.5 | Sep 19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c Affected: 10; 13 |
| CVE-2017-15139 | 7.5 | Aug 27 | A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data Affected: 10; 13 |
| CVE-2018-10915 | 7.5 | Aug 9 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections Affected: 12; 13 |
| CVE-2018-10903 | 7.5 | Jul 30 | A flaw was found in python-cryptography versions between >=1.9.0 and <2.3 Affected: 13 |
| CVE-2017-7539 | 7.5 | Jul 26 | An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9599 | 7.5 | Apr 24 | puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port… Affected: 10 |
| CVE-2018-1000127 | 7.5 | Mar 13 | memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash… Affected: 10 |
| CVE-2018-1000115 | 7.5 | Mar 5 | Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that… Affected: 8; 9; 10; 11; 12 |
| CVE-2017-18191 | 7.5 | Feb 19 | An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1 Affected: 9; 10; 12 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2017-8309 | 7.5 | May 23 | Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-4985 | 7.5 | Jul 12 | The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by… Affected: 7.0; 8 |
| CVE-2015-5271 | 7.5 | Apr 15 | The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the… Affected: 7.0 |
| CVE-2015-8080 | 7.5 | Apr 13 | Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a… Affected: 6.0; 7.0 |