netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-22w9-j288-8p9w
GHSA-27q4-38qf-m25h
GHSA-43cm-73px-5v4m
GHSA-99rx-9x8v-9j8p
GHSA-9hcj-h2qc-689p
GHSA-cm54-3vvf-f5p8
GHSA-m454-cm7h-rqhh
GHSA-mfg4-9xf4-f45q
GHSA-pjvw-p2v5-wf6q
GHSA-q3rw-wcj6-8cjf
GHSA-rwhr-h69g-8qmq
GHSA-v725-c588-h936
GHSA-27q4-38qf-m25h
GHSA-pjvw-p2v5-wf6q
GHSA-v725-c588-h936
This commit is contained in:
advisory-database[bot]
2024-05-14 21:28:27 +00:00
parent 1dd0665081
commit 6c2892241b
15 changed files with 613 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-22w9-j288-8p9w/GHSA-22w9-j288-8p9w.json → advisories/github-reviewed/2022/05/GHSA-22w9-j288-8p9w/GHSA-22w9-j288-8p9w.json
+40 -5
View File
@@ -1,27 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-22w9-j288-8p9w",
"modified": "2022-05-17T04:50:15Z",
"modified": "2024-05-14T21:27:11Z",
"published": "2022-05-17T04:50:15Z",
"aliases": [
"CVE-2013-6419"
],
"details": "Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.",
"summary": "OpenStack Nova Router metadata queries are not restricted by tenant",
"details": "Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (`agent/metadata/agent.py`) in Neutron.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6419"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/07006be9165d1008ca0382b6f0ad25b13a676a55"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/af2f823107010933ecd94a9c938f8b739baaecb7"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/bce36e9bdb1fcb9658f7b684d160e656e88d816c"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/neutron/+bug/1235450"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py"
@@ -52,8 +87,8 @@
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:10Z",
"nvd_published_at": "2014-01-07T18:55:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-27q4-38qf-m25h/GHSA-27q4-38qf-m25h.json
+86
View File
@@ -0,0 +1,86 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27q4-38qf-m25h",
"modified": "2024-05-14T21:27:12Z",
"published": "2022-05-17T04:58:30Z",
"aliases": [
"CVE-2013-4497"
],
"summary": "OpenStack Compute Nova Improper Access Control",
"details": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4497"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/01de658210fd65171bfbf5450c93673b5ce0bd9e"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/5cced7a6dd32d231c606e25dbf762d199bf9cca7"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/ba0d007fb78bd1182c3c0b808dbd7ccc84640e80"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/df2ea2e3acdede21b40d47b7adbeac04213d031b"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1073306"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1202266"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:12Z",
"nvd_published_at": "2013-11-05T20:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-43cm-73px-5v4m/GHSA-43cm-73px-5v4m.json → advisories/github-reviewed/2022/05/GHSA-43cm-73px-5v4m/GHSA-43cm-73px-5v4m.json
+39 -4
View File
@@ -1,27 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43cm-73px-5v4m",
"modified": "2022-05-17T05:04:20Z",
"modified": "2024-05-14T21:27:13Z",
"published": "2022-05-17T05:04:20Z",
"aliases": [
"CVE-2013-4278"
],
"summary": "OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors",
"details": "The \"create an instance\" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4278"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossa/+bug/1212179"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html"
@@ -36,8 +71,8 @@
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:13Z",
"nvd_published_at": "2013-09-16T19:14:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-99rx-9x8v-9j8p/GHSA-99rx-9x8v-9j8p.json → advisories/github-reviewed/2022/05/GHSA-99rx-9x8v-9j8p/GHSA-99rx-9x8v-9j8p.json
+39 -4
View File
@@ -1,23 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99rx-9x8v-9j8p",
"modified": "2022-05-17T01:29:42Z",
"modified": "2024-05-14T21:27:09Z",
"published": "2022-05-17T01:29:42Z",
"aliases": [
"CVE-2013-7130"
],
"summary": "OpenStack Nova Live migration can leak root disk into ephemeral storage",
"details": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7130"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/15ee7e17f63f5583307a546ecf28952c364c88f9"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/b0d36683fe064b32cbef013e1c0c46bd018ab9a1"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/cbeb5e51886b0296349fc476305bfe3d63c627c3"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1251590"
@@ -26,6 +57,10 @@
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/68658"
@@ -76,8 +111,8 @@
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:09Z",
"nvd_published_at": "2014-02-06T17:00:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9hcj-h2qc-689p/GHSA-9hcj-h2qc-689p.json → advisories/github-reviewed/2022/05/GHSA-9hcj-h2qc-689p/GHSA-9hcj-h2qc-689p.json
+43 -4
View File
@@ -1,27 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9hcj-h2qc-689p",
"modified": "2022-05-17T03:15:10Z",
"modified": "2024-05-14T21:25:56Z",
"published": "2022-05-17T03:15:10Z",
"aliases": [
"CVE-2015-1851"
],
"summary": "OpenStack Cinder file disclosure in image convert",
"details": "OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cinder"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1851"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/9634b76ba5886d6c2f2128d550cb005dabf48213"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/b1143ee45323e63b965a3710f9063e65b252c978"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/bc0549e08b010edb863d409d80114aa78d317a61"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/d31c937c566005dedf41a60c6b5bd5e7b26f221b"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/cinder/+bug/1415087"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/cinder"
},
{
"type": "WEB",
"url": "http://lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html"
@@ -56,8 +95,8 @@
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:25:56Z",
"nvd_published_at": "2015-06-25T16:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-cm54-3vvf-f5p8/GHSA-cm54-3vvf-f5p8.json → advisories/github-reviewed/2022/05/GHSA-cm54-3vvf-f5p8/GHSA-cm54-3vvf-f5p8.json
+28 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cm54-3vvf-f5p8",
"modified": "2022-05-17T05:25:39Z",
"modified": "2024-05-14T21:27:17Z",
"published": "2022-05-17T05:25:39Z",
"aliases": [
"CVE-2012-3361"
],
"details": "virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.",
"summary": "OpenStack Nova Arbitrary file injection/corruption through directory traversal issues",
"details": "`virt/disk/api.py` in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
@@ -30,6 +49,10 @@
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1015531"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://lists.launchpad.net/openstack/msg14089.html"
@@ -68,8 +91,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:17Z",
"nvd_published_at": "2012-07-22T16:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m454-cm7h-rqhh/GHSA-m454-cm7h-rqhh.json → advisories/github-reviewed/2022/05/GHSA-m454-cm7h-rqhh/GHSA-m454-cm7h-rqhh.json
+28 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m454-cm7h-rqhh",
"modified": "2022-05-17T05:25:39Z",
"modified": "2024-05-14T21:27:19Z",
"published": "2022-05-17T05:25:39Z",
"aliases": [
"CVE-2012-3360"
],
"details": "Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.",
"summary": "OpenStack Nova Directory traversal vulnerability",
"details": "Directory traversal vulnerability in `virt/disk/api.py` in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
@@ -30,6 +49,10 @@
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1015531"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://lists.launchpad.net/openstack/msg14089.html"
@@ -60,8 +83,8 @@
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:19Z",
"nvd_published_at": "2012-07-22T16:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mfg4-9xf4-f45q/GHSA-mfg4-9xf4-f45q.json → advisories/github-reviewed/2022/05/GHSA-mfg4-9xf4-f45q/GHSA-mfg4-9xf4-f45q.json
+35 -4
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mfg4-9xf4-f45q",
"modified": "2022-05-14T01:58:45Z",
"modified": "2024-05-14T21:25:58Z",
"published": "2022-05-14T01:58:45Z",
"aliases": [
"CVE-2013-4202"
],
"summary": "OpenStack Cinder Denial of Service using XML entities ",
"details": "The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cinder"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.0a0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,18 @@
"type": "WEB",
"url": "https://bugs.launchpad.net/ossa/+bug/1190229"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/cinder"
},
{
"type": "WEB",
"url": "http://github.com/openstack/cinder/commit/2023eecc4b1a35daf42a64fa01967ed12c7d017b"
},
{
"type": "WEB",
"url": "http://github.com/openstack/cinder/commit/4ad95dba4fccbbc0df923dea0dc9e5c3ac9f4cc2"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1198.html"
@@ -36,8 +67,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:25:58Z",
"nvd_published_at": "2013-09-16T19:14:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-pjvw-p2v5-wf6q/GHSA-pjvw-p2v5-wf6q.json
+82
View File
@@ -0,0 +1,82 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pjvw-p2v5-wf6q",
"modified": "2024-05-14T21:27:08Z",
"published": "2022-05-14T01:59:36Z",
"aliases": [
"CVE-2012-1585"
],
"summary": "OpenStack Nova Long server names grow nova-api log files significantly",
"details": "OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1585"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/962515"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "http://github.com/openstack/nova/commit/0fa7d12dbfb7ae016657dd91034b4c0781ea43de"
},
{
"type": "WEB",
"url": "http://github.com/openstack/nova/commit/1ebec5726c7a9db0a6f29fad0ef747b0c087f702"
},
{
"type": "WEB",
"url": "http://github.com/openstack/nova/commit/c7f526fae6062e9ab51f65474af71d496aa66554"
},
{
"type": "WEB",
"url": "http://github.com/openstack/nova/commit/c869a41951b77c6930bf4fb4734f05cd3d6ac4b1"
},
{
"type": "WEB",
"url": "http://lwn.net/Alerts/491298"
},
{
"type": "WEB",
"url": "http://osdir.com/ml/openstack-cloud-computing/2012-03/msg01133.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:08Z",
"nvd_published_at": "2012-08-17T00:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-q3rw-wcj6-8cjf/GHSA-q3rw-wcj6-8cjf.json → advisories/github-reviewed/2022/05/GHSA-q3rw-wcj6-8cjf/GHSA-q3rw-wcj6-8cjf.json
+35 -4
View File
@@ -1,27 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q3rw-wcj6-8cjf",
"modified": "2022-05-17T04:58:58Z",
"modified": "2024-05-14T21:25:51Z",
"published": "2022-05-17T04:58:58Z",
"aliases": [
"CVE-2013-4183"
],
"summary": "OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots",
"details": "The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cinder"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4183"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/0ee31073c5cb432a9cdd2648e99aa802b0ed0a17"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/68c597e26b5659a036a7a937622e539bac102308"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/cinder/+bug/1198185"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/cinder"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1198.html"
@@ -36,8 +67,8 @@
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:25:51Z",
"nvd_published_at": "2013-09-16T19:14:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rwhr-h69g-8qmq/GHSA-rwhr-h69g-8qmq.json → advisories/github-reviewed/2022/05/GHSA-rwhr-h69g-8qmq/GHSA-rwhr-h69g-8qmq.json
+27 -4
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rwhr-h69g-8qmq",
"modified": "2022-05-17T05:15:11Z",
"modified": "2024-05-14T21:27:16Z",
"published": "2022-05-17T05:15:11Z",
"aliases": [
"CVE-2012-5625"
],
"summary": "OpenStack Nova Information leak in libvirt LVM-backed instances",
"details": "OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.0a0"
}
]
}
]
}
],
"references": [
{
@@ -34,6 +53,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=884293"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://launchpad.net/nova/folsom/2012.2.2"
@@ -64,8 +87,8 @@
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:15Z",
"nvd_published_at": "2012-12-26T22:55:00Z"
}
}
advisories/github-reviewed/2022/08/GHSA-v725-c588-h936/GHSA-v725-c588-h936.json
+131
View File
@@ -0,0 +1,131 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v725-c588-h936",
"modified": "2024-05-14T21:27:20Z",
"published": "2022-08-04T00:00:26Z",
"aliases": [
"CVE-2022-37394"
],
"summary": "OpenStack Nova Changing vnic_type breaks compute service restart",
"details": "An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "23.2.2"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "24.0.0"
},
{
"fixed": "24.1.2"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "25.0.0"
},
{
"fixed": "25.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37394"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/0c87681135cfb3ce61d2a0392928c1dbc1fe5fde"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/1a98a1a650d065a8ab3e1c474f3b9fd537dc2206"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/4954f993680c75fd9d3d507f2dcd00300c9b3d44"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/a28c82719545d5c8ee7f3ff1361b3a796e05095a"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/e43bf900dc8ca66578603bed333c56b215b1876e"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/f8c91eb75fc5504a37fc3b4be1d65d33dbc9b511"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossa/+bug/1981813"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/nova/+/849985"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/nova/+/850003"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:27:20Z",
"nvd_published_at": "2022-08-03T07:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-27q4-38qf-m25h/GHSA-27q4-38qf-m25h.json
-47
View File
@@ -1,47 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27q4-38qf-m25h",
"modified": "2022-05-17T04:58:30Z",
"published": "2022-05-17T04:58:30Z",
"aliases": [
"CVE-2013-4497"
],
"details": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4497"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1073306"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/1202266"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-11-05T20:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-pjvw-p2v5-wf6q/GHSA-pjvw-p2v5-wf6q.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pjvw-p2v5-wf6q",
"modified": "2022-05-14T01:59:36Z",
"published": "2022-05-14T01:59:36Z",
"aliases": [
"CVE-2012-1585"
],
"details": "OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1585"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/nova/+bug/962515"
},
{
"type": "WEB",
"url": "http://lwn.net/Alerts/491298"
},
{
"type": "WEB",
"url": "http://osdir.com/ml/openstack-cloud-computing/2012-03/msg01133.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-08-17T00:55:00Z"
}
}
advisories/unreviewed/2022/08/GHSA-v725-c588-h936/GHSA-v725-c588-h936.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v725-c588-h936",
"modified": "2022-08-11T00:00:38Z",
"published": "2022-08-04T00:00:26Z",
"aliases": [
"CVE-2022-37394"
],
"details": "An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37394"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossa/+bug/1981813"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/nova/+/849985"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/nova/+/850003"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-03T07:15:00Z"
}
}