Description
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | horizon | 3:18.6.1-1 | — |
| Debian 13 | horizon | 3:18.6.1-1 | — |
| Debian 12 | horizon | 3:18.6.1-1 | — |
| Debian 10 | horizon | 3:14.0.2-3+deb10u2 | DSA-4820-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | horizon | 3:18.3.2-0ubuntu0.20.04.4 | USN-4675-1 |
| Ubuntu 18.04 LTS | horizon | 3:13.0.3-0ubuntu2 | USN-4675-1 |
| Ubuntu 16.04 LTS | horizon | 2:9.1.2-0ubuntu5.2 | USN-4675-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 16 | openstack-dashboard +2 | 1:16.2.1-1.20201114033610.el8ost | RHSA-2020:5411 |
| Red Hat OpenStack 13 | openstack-dashboard +1 | 1:13.0.3-7.el7ost | RHSA-2020:5572 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 8 | openstack-dashboard | 12.0.5~dev6-3.29.1 | SUSE-SU-2021:0099-1 |
| SUSE OpenStack Cloud Crowbar 8 | release-notes-suse-openstack-cloud | 8.20201214-3.26.1 | SUSE-SU-2021:0099-1 |
| SUSE OpenStack Cloud 8 | openstack-dashboard | 12.0.5~dev6-3.29.1 | SUSE-SU-2021:0099-1 |
| SUSE OpenStack Cloud 8 | release-notes-suse-openstack-cloud | 8.20201214-3.26.1 | SUSE-SU-2021:0099-1 |
| SUSE HPE Helion OpenStack 8 | openstack-dashboard | 12.0.5~dev6-3.29.1 | SUSE-SU-2021:0099-1 |
| SUSE HPE Helion OpenStack 8 | release-notes-hpe-helion-openstack | 8.20201214-3.26.1 | SUSE-SU-2021:0099-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | horizon | < 15.3.2 | 15.3.2 | GHSA-f8fh-xp28-q59m |
| PyPI | horizon | >= 16.0.0, < 16.2.1 | 16.2.1 | GHSA-f8fh-xp28-q59m |
| PyPI | horizon | >= 17.0.0, < 18.3.3 | 18.3.3 | GHSA-f8fh-xp28-q59m |
| PyPI | horizon | >= 18.4.0, < 18.6.0 | 18.6.0 | GHSA-f8fh-xp28-q59m |
| PyPI | horizon | >= 15.3.0, < 15.3.2 · >= 16.0.0, < 16.2.1 · >= 17.0.0, < 18.3.3 · >= 18.4.0, < 18.6.0 | 15.3.2, 16.2.1, 18.3.3, 18.6.0 | PYSEC-2020-45 |
Advisories 5
- RHSA-2020:5572 Red Hat Security Advisory: python-django-horizon security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5411 Red Hat Security Advisory: python-django-horizon security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4820-1 horizon - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4675-1 horizon vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2021:0099-1 Security update for openstack-dashboard, release-notes-suse-openstack-cloud SUSE / openSUSE Security Updates · May 2, 2025
References
- https://bugs.launchpad.net/horizon/+bug/1865026
- https://review.opendev.org/c/openstack/horizon/+/758841/
- https://review.opendev.org/c/openstack/horizon/+/758843/
- https://security.openstack.org/ossa/OSSA-2020-008.html
- [oss-security] 20201207 [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565) mailing-list
- DSA-4820 vendor-advisory