Skip to content
OpenAdvisories
High WID-SEC-2022-0439 4 CVEs

Red Hat OpenStack: Mehrere Schwachstellen

Published Jun 22, 2022 · Updated Dec 7, 2022 · Revision 6 · de-DE

Vendor: Debian Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Product: OpenStack < 16.2.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenStack ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.

Product

Red Hat OpenStack ist eine Sammlung von Diensten, um Cloud-Computing in Form von Infrastructure as a Service (IaaS) bereitstellen zu können.

Vulnerabilities 4

  • Critical 9.8
    CVE-2022-28346 Public exploit EPSS 19%

    SQL Injection in Django

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 8.1
    CVE-2022-23451

    Barbican authorization flaw before v14.0.0

    An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network …

    barbican barbican barbican Debian Ubuntu PyPI
  • Medium 5.6
    CVE-2022-0675

    Puppet Firewall Module May Leave Unmanaged Rules

    In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe stat…

    Puppet Firewall Module puppet-module-puppetlabs-firewall puppet-module-puppetlabs-firewall Debian Ubuntu
  • Medium 4.9
    CVE-2022-23452

    openstack-barbican Denial of Service vulnerability

    An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.

    barbican barbican barbican Debian Ubuntu PyPI

Revision history

  1. #6

    Neue Updates von Red Hat aufgenommen

  2. #5

    Neue Updates von Debian aufgenommen

  3. #4

    Neue Updates von SUSE aufgenommen

  4. #3

    Neue Updates von Red Hat aufgenommen

  5. #2

    Neue Updates von Red Hat aufgenommen

  6. #1

    Initiale Fassung

References