Page 2 of 16 results (0.011 seconds)

CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 1

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected. Se detectó un problema en la función Guest.migrate en el archivo virt/libvirt/guest.py en OpenStack Nova versiones anteriores a 19.3.1, versiones 20.x anteriores a 20.3.1 y 21.0.0. • http://www.openwall.com/lists/oss-security/2020/08/25/4 https://launchpad.net/bugs/1890501 https://security.openstack.org/ossa/OSSA-2020-006.html https://access.redhat.com/security/cve/CVE-2020-17376 https://bugzilla.redhat.com/show_bug.cgi?id=1869426 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py. • http://www.openwall.com/lists/oss-security/2020/02/19/2 https://launchpad.net/bugs/1492140 https://review.opendev.org/220622 https://security.openstack.org/ossa/OSSA-2020-001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data. Se detectó un problema en OpenStack Nova en versiones anteriores a 17.0.12, versiones 18.x anteriores a 18.2.2, y versiones 19.x anteriores a 19.0.2. Si una petición de la API de un usuario autenticado termina en una condición de fallo debido a una excepción externa, los detalles del entorno subyacente puede ser filtrados en la respuesta, y podrían incluir una configuración confidencial u otros datos. A vulnerability was found in the Nova Compute resource fault handling. • http://www.openwall.com/lists/oss-security/2019/08/06/6 https://access.redhat.com/errata/RHSA-2019:2622 https://access.redhat.com/errata/RHSA-2019:2631 https://access.redhat.com/errata/RHSA-2019:2652 https://launchpad.net/bugs/1837877 https://lists.debian.org/debian-lts-announce/2022/09/msg00018.html https://security.openstack.org/ossa/OSSA-2019-003.html https://usn.ubuntu.com/4104-1 https://access.redhat.com/security/cve/CVE-2019-14433 https://bugzilla.redhat. • CWE-209: Generation of Error Message Containing Sensitive Information •

CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 2

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected. Se ha descubierto un problema en OpenStack Nova en versiones 15.x hasta la 15.1.0 y 16.x hasta la 16.1.1. • http://openwall.com/lists/oss-security/2018/04/20/3 http://www.securityfocus.com/bid/103104 https://access.redhat.com/errata/RHSA-2018:2332 https://access.redhat.com/errata/RHSA-2018:2714 https://access.redhat.com/errata/RHSA-2018:2855 https://launchpad.net/bugs/1739593 https://review.openstack.org/539893 https://security.openstack.org/ossa/OSSA-2018-001.html https://access.redhat.com/security/cve/CVE-2017-18191 https://bugzilla.redhat.com/show_bug.cgi?id=1546937 • CWE-20: Improper Input Validation •

CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected. Se ha descubierto un problema en el FilterScheduler por defecto en OpenStack Nova 16.0.3. Mediante la reconstrucción repetida de una instancia con nuevas imágenes, un usuario autenticado podría consumir recursos no seguidos en un host de hipervisor, lo que conduce a una denegación de servicio (DoS). • http://www.securityfocus.com/bid/102102 https://launchpad.net/bugs/1732976 https://review.openstack.org/521662 https://review.openstack.org/523214 https://security.openstack.org/ossa/OSSA-2017-006.html • CWE-400: Uncontrolled Resource Consumption •