Skip to content
OpenAdvisories
High WID-SEC-2022-2265 10 CVEs

Red Hat OpenStack: Mehrere Schwachstellen

Published Dec 7, 2022 · Updated May 18, 2025 · Revision 9 · de-DE

Vendor: amazon Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux 2 Product: OpenStack Product: openSUSE Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenStack ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.

Product

Red Hat OpenStack ist eine Sammlung von Diensten, um Cloud-Computing in Form von Infrastructure as a Service (IaaS) bereitstellen zu können.

Vulnerabilities 10

  • Critical 9.8
    CVE-2022-28346 Public exploit EPSS 19%

    SQL Injection in Django

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2022-37026

    In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass i…

    erlang erlang erlang erlang26 Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-23833 EPSS 50%

    Infinite Loop in Django

    An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2022-31116

    Incorrect handling of invalid surrogate pair characters in ujson

    UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were…

    ultrajson ultrajson ujson ujson Debian Ubuntu Alpine PyPI
  • High 7.4
    CVE-2022-2996

    python-scciclient vulnerable to Man-in-the-middle (MITM) attacks

    A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.

    python-scciclient python-scciclient python-scciclient Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2021-27025

    Silent Configuration Failure in Puppet Agent

    A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

    puppet puppet puppet Debian Ubuntu RubyGems
  • Medium 6.5
    CVE-2022-3277

    openstack-neutron uncontrolled resource consumption flaw

    An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a mal…

    neutron neutron neutron Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2022-22818 Public exploit

    Cross-site Scripting in Django

    The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.9
    CVE-2022-31117

    Double free of buffer during string decoding in ujson

    UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the …

    ultrajson ultrajson ujson ujson Debian Ubuntu Alpine PyPI
  • Medium 4.3
    CVE-2023-3637

    Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)

    An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a mal…

    Red Hat Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 17.1 Ubuntu PyPI

Revision history

  1. #9

    Neue Updates von openSUSE aufgenommen

  2. #8

    Neue Updates von Ubuntu aufgenommen

  3. #7

    Neue Updates von Amazon aufgenommen

  4. #6

    CVE's ergänzt

  5. #5

    Neue Updates von Red Hat aufgenommen

  6. #4

    Neue Updates von Ubuntu aufgenommen

  7. #3

    Neue Updates von Ubuntu aufgenommen

  8. #2

    Neue Updates von Red Hat aufgenommen

  9. #1

    Initiale Fassung

References