CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-4222 – OpenStack: Keystone disabling a tenant does not disable a user token
https://notcve.org/view.php?id=CVE-2013-4222
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token. OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 y anteriores, y Havana anterior havana-3 no revoca correctamente los tokens de usuario cuando un inquilino esta desactivado, lo que permite a los usuarios remotos autenticados conservan el acceso a través del token. • http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html http://rhn.redhat.com/errata/RHSA-2013-1524.html http://www.ubuntu.com/usn/USN-2002-1 https://bugs.launchpad.net/ossn/+bug/1179955 https://access.redhat.com/security/cve/CVE-2013-4222 https://bugzilla.redhat.com/show_bug.cgi?id=995598 • CWE-522: Insufficiently Protected Credentials CWE-613: Insufficient Session Expiration •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 1CVE-2013-4185 – OpenStack: Nova network source security groups denial of service
https://notcve.org/view.php?id=CVE-2013-4185
Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests. Vulnerabilidad de la complejidad algorítmica en OpenStack Compute (Nova) anteriores 03/01/2013 y Havana anterior a habana-3 no controla correctamente las actualizaciones de directiva de grupo de seguridad de código de red, lo que permite a usuarios remotos autenticados causar una denegación de servicio (consumo nova de la red) a través de una gran número de operaciones del servidor de creación, que desencadena un gran número de solicitudes de actualización. • http://rhn.redhat.com/errata/RHSA-2013-1199.html http://seclists.org/oss-sec/2013/q3/282 https://bugs.launchpad.net/nova/+bug/1184041 https://access.redhat.com/security/cve/CVE-2013-4185 https://bugzilla.redhat.com/show_bug.cgi?id=993331 • CWE-310: Cryptographic Issues •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 2CVE-2013-4261 – OpenStack: openstack-nova-compute console-log DoS
https://notcve.org/view.php?id=CVE-2013-4261
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log. En OpenStack Compute (Nova) Folsom, Grizzly, y anteriores, cuando se utiliza Apache Qpid para el backend RPC, no maneja adecuadamente los errores que se producen durante la mensajería, que permite a atacantes remotos provocar una denegación de servicio (conexión consumo piscina), como lo demuestra el uso de múltiples solicitudes que envían cadenas largas a una consola de instancia y recuperar el registro de la consola. • http://rhn.redhat.com/errata/RHSA-2013-1199.html http://seclists.org/oss-sec/2013/q3/595 https://bugs.launchpad.net/nova/+bug/1215091 https://bugzilla.redhat.com/show_bug.cgi?id=999164 https://bugzilla.redhat.com/show_bug.cgi?id=999271 https://access.redhat.com/security/cve/CVE-2013-4261 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2013-2167 – python-keystoneclient: middleware memcache encryption and signing bypass
https://notcve.org/view.php?id=CVE-2013-2167
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass python-keystoneclient versiones 0.2.3 hasta la versión 0.2.5, tiene una omisión de firma de memcache de middleware. • http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.html http://rhn.redhat.com/errata/RHSA-2013-0992.html http://www.openwall.com/lists/oss-security/2013/06/19/5 http://www.securityfocus.com/bid/60680 https://access.redhat.com/security/cve/cve-2013-2167 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-2167 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2167 https://exchange.xforce.ibmcloud.com/vulnerabilities/85492 https://security-tracker.de • CWE-345: Insufficient Verification of Data Authenticity CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2013-2166 – python-keystoneclient: middleware memcache encryption and signing bypass
https://notcve.org/view.php?id=CVE-2013-2166
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass python-keystoneclient versión 0.2.3 hasta la versión 0.2.5, tiene una omisión de cifrado de memcache del middleware. • http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.html http://rhn.redhat.com/errata/RHSA-2013-0992.html http://www.openwall.com/lists/oss-security/2013/06/19/5 http://www.securityfocus.com/bid/60684 https://access.redhat.com/security/cve/cve-2013-2166 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2166 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2166 https://security-tracker.debian.org/tracker/CVE-2013-2166 https://access.redhat& • CWE-326: Inadequate Encryption Strength CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data •