CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2013-1865 – keystone: online validation of Keystone PKI tokens bypasses revocation check
https://notcve.org/view.php?id=CVE-2013-1865
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token. OpenStack Keystone Folsom (2012.2) no lleva a cabo todas las comprobaciones de revocación de tokens Keystone PKI cuando se hace a través de un servidor, lo que permite a atacantes remotos evitar las restricciones de acceso destinados a través de un token de revocar PKI. • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101719.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00000.html http://osvdb.org/91532 http://rhn.redhat.com/errata/RHSA-2013-0708.html http://secunia.com/advisories/52657 http://www.openwall.com/lists/oss-security/2013/03/20/13 http://www.securityfocus.com/bid/58616 http://www.ubuntu.com/usn/USN-1772-1 https://bugs.launchpad.net/keystone/+bug/1129713 https://review.openstack.org/# • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 3.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1840 – Glance: Backend credentials leak in Glance v1 API
https://notcve.org/view.php?id=CVE-2013-1840
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image. La API v1 en OpenStack Vistazo Essex (2012.1), Folsom (2012.2) y Grizzly, al utilizar el 'single-tenant Swift' o la tienda S3, informa el campo de ubicación, lo que permite obtener las credenciales del back-end del operador a usuarios remotos autenticados a través de una solicitud de una imagen almacenada en caché. • http://osvdb.org/91304 http://rhn.redhat.com/errata/RHSA-2013-0707.html http://secunia.com/advisories/52565 http://www.openwall.com/lists/oss-security/2013/03/14/15 http://www.securityfocus.com/bid/58490 http://www.ubuntu.com/usn/USN-1764-1 https://bugs.launchpad.net/glance/+bug/1135541 https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 https://review.openstack.org/#/c/24437 https://review.openstack.org/#/c/24438 https://review.openstack.org&#x • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0261 – packstack: insecure use of /tmp in manifest creation
https://notcve.org/view.php?id=CVE-2013-0261
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. (1) installer/basedefs.py y (2) modules/ospluginutils.py en PackStack permite a los usuarios locales sobreescribir ficheros de su elección mediante un ataque de enlaces simbólicos en un archivo temporal con un nombre predecible en /tmp. • http://rhn.redhat.com/errata/RHSA-2013-0595.html https://bugzilla.redhat.com/show_bug.cgi?id=908101 https://access.redhat.com/security/cve/CVE-2013-0261 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0266 – packstack: puppetlabs-cinder / manifests / base.pp weak file permissions
https://notcve.org/view.php?id=CVE-2013-0266
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files. manifests/base.pp en el módulo puppetlabs-cinder, tal como se utiliza en PackStack le da permisos de lectura para todo el mundo a los archovs de configuración (1) cinder.conf y (2) api-paste.ini, lo que permite a usuarios locales leer contraseñas de administarción de OpenStack mediante la lectura de dichos archivos. • http://rhn.redhat.com/errata/RHSA-2013-0595.html https://bugzilla.redhat.com/show_bug.cgi?id=908581 https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc https://access.redhat.com/security/cve/CVE-2013-0266 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.0EPSS: 9%CPEs: 6EXPL: 1CVE-2013-1664 – bindings: Internal entity expansion in Python XML libraries inflicts DoS vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1664
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. OpenStack Keystone Essex, Folsom, y Grizzly; Compute (Nova) Essex y Folsom, Folsom y Cinder permite a atacantes remotos provocar una denegación de servicio (consumo de recursos y caída) mediante un ataque de Entidad de expansión XML(XEE). • http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html http://bugs.python.org/issue17239 http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html http://rhn.redhat.com/errata/RHSA-2013-0657.html http://rhn.redhat.com/errata/RHSA-2013-0658.html http://rhn.redhat.com/errata/RHSA-2013-0670.html http://ubuntu.com/usn/usn-1757-1 http://www.openwall.com/lists/oss-security/2013/02/19/2 http://www.openwall.com/lists/oss-security • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •