Description
The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | redhat-access-plugin-openstack | 6.0.3-0.el7ost | RHSA-2015:0645 |
| Red Hat OpenStack 5 | redhat-access-plugin-openstack | 5.0.1-0.el6ost | RHSA-2015:0841, RHSA-2015:0840 |
Advisories 3
- RHSA-2015:0841 Red Hat Security Advisory: redhat-access-plugin security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:0840 Red Hat Security Advisory: redhat-access-plugin security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2015:0645 Red Hat Security Advisory: redhat-access-plugin-openstack security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
References
- RHSA-2015:0841 vendor-advisory
- RHSA-2015:0645 vendor-advisory
- RHSA-2015:0840 vendor-advisory