OP
Product
Openstack
209
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 57Medium 87Low 7
Watch
Add Openstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-16785 | 7.5 | Dec 20 | Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a… Affected: 15 |
| CVE-2013-1793 | 7.5 | Dec 10 | openstack-utils openstack-db has insecure password creation Affected: 2.1; 3.0; 4.0 |
| CVE-2019-11287 | 7.5 | Nov 23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4,… Affected: 15 |
| CVE-2019-14818 | 7.5 | Nov 14 | A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with… Affected: 10 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 14 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 14 |
| CVE-2018-16856 | 7.5 | Mar 26 | In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log… Affected: 12; 13; 14 |
| CVE-2018-17205 | 7.5 | Sep 19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c Affected: 10; 13 |
| CVE-2017-15139 | 7.5 | Aug 27 | A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data Affected: 10; 13 |
| CVE-2018-10915 | 7.5 | Aug 9 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections Affected: 12; 13 |
| CVE-2018-10903 | 7.5 | Jul 30 | A flaw was found in python-cryptography versions between >=1.9.0 and <2.3 Affected: 13 |
| CVE-2017-7539 | 7.5 | Jul 26 | An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-9599 | 7.5 | Apr 24 | puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port… Affected: 10 |
| CVE-2018-1000127 | 7.5 | Mar 13 | memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash… Affected: 10 |
| CVE-2018-1000115 | 7.5 | Mar 5 | Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that… Affected: 8; 9; 10; 11; 12 |
| CVE-2017-18191 | 7.5 | Feb 19 | An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1 Affected: 9; 10; 12 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2017-8309 | 7.5 | May 23 | Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio… Affected: 6.0; 7.0; 8; 9; 10; 11 |
| CVE-2016-4985 | 7.5 | Jul 12 | The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by… Affected: 7.0; 8 |
| CVE-2015-5271 | 7.5 | Apr 15 | The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the… Affected: 7.0 |
| CVE-2015-8080 | 7.5 | Apr 13 | Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a… Affected: 6.0; 7.0 |
| CVE-2019-0223 | 7.4 | Apr 23 | While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a… Affected: 13; 14 |
| CVE-2015-5329 | 7.3 | Apr 11 | The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the configured RabbitMQ credentials, which… Affected: 7.0 |
| CVE-2019-10193 | 7.2 | Jul 11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 9; 10; 13; 14 |
| CVE-2019-10192 | 7.2 | Jul 11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 9; 10; 13; 14 |
| CVE-2017-2673 | 7.2 | Jul 19 | An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone) Affected: 9; 10 |
| CVE-2020-10684 | 7.1 | Mar 24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting… Affected: 10; 13 |
| CVE-2018-2562 | 7.1 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition) Affected: 12 |
| CVE-2020-1759 | 6.8 | Apr 13 | A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the… Affected: 15 |
| CVE-2020-14355 | 6.6 | Oct 7 | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1 Affected: 16.1 |
| CVE-2023-2088 | 6.5 | May 12 | A flaw was found in OpenStack due to an inconsistency between Cinder and Nova Affected: All versions, or not specified |
| CVE-2022-1655 | 6.5 | Jul 22 | An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack Affected: 16.2 |
| CVE-2021-3930 | 6.5 | Feb 18 | An off-by-one error was found in the SCSI device emulation in QEMU Affected: 10; 13 |
| CVE-2020-10756 | 6.5 | Jul 9 | An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator Affected: 13 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: 10; 13; 14 |
| CVE-2020-10753 | 6.5 | Jun 26 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) Affected: 15 |
| CVE-2019-14856 | 6.5 | Nov 26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None Affected: 13 |
| CVE-2013-6461 | 6.5 | Nov 5 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits Affected: 3.0; 4.0 |
| CVE-2013-6460 | 6.5 | Nov 5 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents Affected: 3.0; 4.0 |
| CVE-2019-14433 | 6.5 | Aug 9 | An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2 Affected: 10; 13; 14 |
| CVE-2019-10876 | 6.5 | Apr 5 | An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 Affected: 13; 14 |
| CVE-2019-9735 | 6.5 | Mar 13 | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 Affected: 10; 13; 14 |
| CVE-2018-14635 | 6.5 | Sep 10 | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation Affected: 10; 12; 13 |
| CVE-2016-9590 | 6.5 | Apr 26 | puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift) Affected: 8; 9; 10 |
| CVE-2018-2819 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 12 |
| CVE-2018-2817 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |
| CVE-2018-2668 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2018-2665 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2018-2640 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 12 |
| CVE-2018-2622 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 12 |