CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-44020 – VirtualBMC: removes password protection from the managed libvirt XML domain
https://notcve.org/view.php?id=CVE-2022-44020
29 Oct 2022 — An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration." Se descubrió un problema en OpenStack Sushy-Tools hasta 0.21.0 y VirtualBMC hasta 2.2.2. Cambiar la configuración del dispositivo de arranque con estos paquetes elimina la protección con contraseña del dominio XML libvirt... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE • CWE-281: Improper Preservation of Permissions CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 9.1EPSS: 1%CPEs: 4EXPL: 0CVE-2019-17134 – openstack-octavia: amphora-agent not requiring client certificate
https://notcve.org/view.php?id=CVE-2019-17134
08 Oct 2019 — Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED. Amphora Images en OpenStack Octavia versiones posteriores e incluyendo a 0.10.0 anteriores a 2.1.2, versiones p... • https://access.redhat.com/errata/RHSA-2019:3743 • CWE-287: Improper Authentication CWE-471: Modification of Assumed-Immutable Data (MAID) •