“Nova Core security contacts” team

Subscribed bugs


1 → 50 of 55 results First • Previous • • Last
Critical
Confirmed
#1546507 Regular user in non-default non-recommended configuration can delete any image file
Glance 42
Critical
Confirmed
#1546507 Regular user in non-default non-recommended configuration can delete any image file
Glance liberty 42
Critical
Confirmed
#1546507 Regular user in non-default non-recommended configuration can delete any image file
Glance ocata 42
Critical
Confirmed
#1546507 Regular user in non-default non-recommended configuration can delete any image file
Glance newton 42
Critical
Confirmed
#1546507 Regular user in non-default non-recommended configuration can delete any image file
Glance mitaka 42
High
In Progress
#1255609 VMware: possible collision of VNC ports
VMwareAPI-Team 14
High
Confirmed
#1549483 Normal user can replace active image data if show_multiple_locations has been set to true
Glance 14
High
Confirmed
#1555590 Image location can be used to capture user tokens
Glance 12
High
Confirmed
#1563954 use_forwarded_for exposes metadata
OpenStack Compute (nova) 10
High
Fix Committed
#1713783 After failed evacuation the recovered source compute tries to delete the instance
OpenStack Compute (nova) ocata 18
High
Fix Committed
#1713783 After failed evacuation the recovered source compute tries to delete the instance
OpenStack Compute (nova) pike 18
High
Fix Committed
#1664931 [OSSA-2017-005] nova rebuild ignores all image properties and scheduler filters (CVE-2017-16239)
OpenStack Compute (nova) newton 276
High
Fix Committed
#1664931 [OSSA-2017-005] nova rebuild ignores all image properties and scheduler filters (CVE-2017-16239)
OpenStack Compute (nova) ocata 276
High
Fix Committed
#1664931 [OSSA-2017-005] nova rebuild ignores all image properties and scheduler filters (CVE-2017-16239)
OpenStack Compute (nova) pike 276
High
Fix Committed
#1732976 [OSSA-2017-006] Potential DoS by rebuilding the same instance with a new image multiple times (CVE-2017-17051)
OpenStack Compute (nova) pike 278
High
Fix Committed
#1739646 Instance type with disk set to 0 can cause DoS
OpenStack Compute (nova) ocata 26
High
Fix Committed
#1739646 Instance type with disk set to 0 can cause DoS
OpenStack Compute (nova) pike 26
High
Fix Committed
#1739646 Instance type with disk set to 0 can cause DoS
OpenStack Compute (nova) queens 26
High
Confirmed
#1798904 tenant isolation is bypassed if port admin-state-up=false
OpenStack Compute (nova) 18
High
Fix Committed
#1837877 [OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433)
OpenStack Compute (nova) stein 278
High
Fix Committed
#1837877 [OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433)
OpenStack Compute (nova) ocata 278
High
Fix Committed
#1837877 [OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433)
OpenStack Compute (nova) rocky 278
High
Fix Committed
#1837877 [OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433)
OpenStack Compute (nova) queens 278
High
Triaged
#1915282 nova allows non string values in pci whitelist for physical_network tag.
OpenStack Compute (nova) 18
Medium
Confirmed
#1447679 service No-VNC (port 6080) doesn't require authentication
OpenStack Compute (nova) 40
Medium
Fix Committed
#1449062 [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
python-oslo.concurrency (Ubuntu Wily) 282
Medium
Fix Committed
#1449062 [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Ubuntu Cloud Archive liberty 282
Medium
Fix Committed
#1449062 [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Ubuntu Cloud Archive mitaka 282
Medium
Fix Committed
#1816727 nova-novncproxy does not handle TCP RST cleanly when using SSL 
OpenStack Compute (nova) rocky 14
Medium
Fix Committed
#1816727 nova-novncproxy does not handle TCP RST cleanly when using SSL 
OpenStack Compute (nova) stein 14
Medium
Confirmed
#1861893 os-assisted-volume-snapshots passes unsanitised file path to the libvirt driver
OpenStack Compute (nova) 14
Medium
Triaged
#1989008 Lax rulesets leading to privilege escalation vulnerabilities
OpenStack Compute (nova) 16
Medium
In Progress
#2030976 oslo notifications sending sensitive tokens
Ironic 264
Medium
Confirmed
#2030976 oslo notifications sending sensitive tokens
OpenStack Security Advisory 264
Undecided
New
#1341954 suds client subject to cache poisoning by local attacker
gantt 262
Undecided
Fix Committed
#1361360 Eventlet green threads not released back to the pool leading to choking of new requests
Glance icehouse 76
Undecided
Fix Committed
#1361360 Eventlet green threads not released back to the pool leading to choking of new requests
neutron juno 76
Undecided
New
#1673569 [OSSA-2017-002] Failed notification payload is dumped in logs with auth secrets (CVE-2017-7214)
Ubuntu Cloud Archive mitaka 262
Undecided
New
#1673569 [OSSA-2017-002] Failed notification payload is dumped in logs with auth secrets (CVE-2017-7214)
nova (Ubuntu Xenial) 262
Undecided
Incomplete
#1700501 Insecure rootwrap usage
OpenStack Compute (nova) 26
Undecided
New
#1700501 Insecure rootwrap usage
Cinder 26
Undecided
New
#1555590 Image location can be used to capture user tokens
OpenStack Security Notes 12
Undecided
New
#1546507 Regular user in non-default non-recommended configuration can delete any image file
OpenStack Security Notes 42
Undecided
New
#1739646 Instance type with disk set to 0 can cause DoS
OpenStack Security Notes 26
Undecided
New
#1798904 tenant isolation is bypassed if port admin-state-up=false
neutron 18
Undecided
New
#1915282 nova allows non string values in pci whitelist for physical_network tag.
neutron 18
Undecided
In Progress
#1927677 [OSSA-2021-002] Open Redirect in noVNC proxy (CVE-2021-3654)
OpenStack Compute (nova) stein 280
Undecided
Triaged
#1989008 Lax rulesets leading to privilege escalation vulnerabilities
oslo.privsep 16
Undecided
New
#1989008 Lax rulesets leading to privilege escalation vulnerabilities
os-brick 16
Undecided
In Progress
#2004555 [OSSA-2023-003] Unauthorized volume access through deleted volume attachments (CVE-2023-2088)
os-brick 294
1 → 50 of 55 results First • Previous • • Last