Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4287 vulnerabilities by pypi
PYSEC-2026-664
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
Severity
7.5 (High)
Impacted products
| Name | purl | matrix-synapse | pkg:pypi/matrix-synapse |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "matrix-synapse",
"purl": "pkg:pypi/matrix-synapse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.31.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-12291",
"GHSA-v8wm-g9f2-xjv4"
],
"details": "The `on_get_missing_events` function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.",
"id": "PYSEC-2026-664",
"modified": "2026-07-02T14:13:24.881978Z",
"published": "2026-07-02T14:13:24.881978Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12291"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/pull/3371"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/commit/0834b49c6a9b6c597a154d4b2dfcf8fff90699ec"
},
{
"type": "PACKAGE",
"url": "https://github.com/matrix-org/synapse"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/releases/tag/v0.31.1"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/matrix-synapse"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-v8wm-g9f2-xjv4"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Matrix Synapse Security Filtering Flaw"
}
PYSEC-2026-682
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.5 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Severity
Impacted products
| Name | purl | mysql-connector-python | pkg:pypi/mysql-connector-python |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mysql-connector-python",
"purl": "pkg:pypi/mysql-connector-python"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-3590",
"GHSA-2cf3-g243-hhfx"
],
"details": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.5 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).",
"id": "PYSEC-2026-682",
"modified": "2026-07-02T14:13:24.741892Z",
"published": "2026-07-02T14:13:24.741892Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3590"
},
{
"type": "PACKAGE",
"url": "https://github.com/mysql/mysql-connector-python"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97840"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038287"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/mysql-connector-python"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-2cf3-g243-hhfx"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "MySQL Connectors Privilege Escalation"
}
PYSEC-2026-689
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.
Severity
7.5 (High)
Impacted products
| Name | purl | nova | pkg:pypi/nova |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova",
"purl": "pkg:pypi/nova"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0"
},
{
"fixed": "15.1.1"
},
{
"introduced": "16.0.0"
},
{
"fixed": "16.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-18191",
"GHSA-ffmh-r67w-m88f"
],
"details": "An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.",
"id": "PYSEC-2026-689",
"modified": "2026-07-02T14:13:24.655107Z",
"published": "2026-07-02T14:13:24.655107Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18191"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/0225a61fc4557c1257383a654f0741f7ef2ddeac"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/5b64a1936122eeb35f37a09f9d38159e1a224c58"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/cd3eb60c2c00bcccfa9ccd4bf9d1a96ae7a5cd88"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2332"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2714"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2855"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/1739593"
},
{
"type": "WEB",
"url": "https://review.openstack.org/539893"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2018-001.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2018/04/20/3"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103104"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/nova"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-ffmh-r67w-m88f"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Nova Denial of service attack on the compute host"
}
PYSEC-2026-692
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.
Severity
8.6 (High)
Impacted products
| Name | purl | nova | pkg:pypi/nova |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova",
"purl": "pkg:pypi/nova"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "16.0.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"15.1.5"
]
}
],
"aliases": [
"CVE-2017-17051",
"GHSA-vq76-rxx3-4r4r"
],
"details": "An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.",
"id": "PYSEC-2026-692",
"modified": "2026-07-06T07:36:58.239452Z",
"published": "2026-07-02T14:13:24.579916Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17051"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/25a1d78e83065c5bea5d8e0a017fd9d0914d41d9"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/fed660c1189fdf4159d97badfdc8c5b35ad14f23"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/1732976"
},
{
"type": "WEB",
"url": "https://review.openstack.org/521662"
},
{
"type": "WEB",
"url": "https://review.openstack.org/523214"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2017-006.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102102"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/nova"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-vq76-rxx3-4r4r"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Nova DoS by rebuilding the same instance with a new image multiple times"
}
PYSEC-2026-694
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.
Severity
6.5 (Medium)
Impacted products
| Name | purl | nova | pkg:pypi/nova |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nova",
"purl": "pkg:pypi/nova"
},
"ranges": [
{
"events": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.0.10"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.8"
},
{
"introduced": "16.0.0"
},
{
"fixed": "16.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-16239",
"GHSA-w2wf-cgwh-vpqg"
],
"details": "In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.",
"id": "PYSEC-2026-694",
"modified": "2026-07-02T14:13:24.507335Z",
"published": "2026-07-02T14:13:24.507335Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16239"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/698b261a5a2a6c0f31ef5059046ef7196d5cba30"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/984dd8ad6add4523d93c7ce5a666a32233e02e34"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/9e2d63da94db63d97bd02e373bfc53d95808b833"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/b72105c1c49fcddc94992af63fc2f8078023491a"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0241"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0314"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0369"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/1664931"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2017-005.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4056"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101950"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/nova"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-w2wf-cgwh-vpqg"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Nova Filter Scheduler Bypass"
}
PYSEC-2026-619
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.
Severity
7.5 (High)
Impacted products
| Name | purl | aodh | pkg:pypi/aodh |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aodh",
"purl": "pkg:pypi/aodh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1.dev4004",
"1.1.0",
"1.1.1",
"1.1.2",
"1.1.3",
"2.0.0",
"2.0.0.0b1",
"2.0.0.0b2",
"2.0.0.0b3",
"2.0.0.0rc1",
"2.0.1",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.5",
"2.0.6",
"3.0.0",
"3.0.0.0b2",
"3.0.0.0b3",
"3.0.0.0rc1",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"4.0.0",
"4.0.1",
"4.0.2",
"4.0.3",
"5.0.0",
"5.1.0",
"5.1.1",
"6.0.0"
]
}
],
"aliases": [
"CVE-2017-12440",
"GHSA-86cv-9gpx-6hwj"
],
"details": "Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.",
"id": "PYSEC-2026-619",
"modified": "2026-07-06T07:36:17.267393Z",
"published": "2026-07-02T14:13:24.418168Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12440"
},
{
"type": "WEB",
"url": "https://github.com/openstack/aodh/commit/149d3ad2193b4d17df801f82a0a6be62dba564db"
},
{
"type": "WEB",
"url": "https://github.com/openstack/aodh/commit/92182de328d1f088c5f5a68326d2b207b21e06ea"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3227"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0315"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossn/+bug/1649333"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/493823"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/493824"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/493826"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3953"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100455"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/aodh"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-86cv-9gpx-6hwj"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Openstack Aodh can be used to launder Keystone trusts"
}
PYSEC-2026-754
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:37
VLAI
Details
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
Severity
6.3 (Medium)
Impacted products
| Name | purl | tripleo-heat-templates | pkg:pypi/tripleo-heat-templates |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tripleo-heat-templates",
"purl": "pkg:pypi/tripleo-heat-templates"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.5.6",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.3",
"0.6.4",
"0.7.0",
"0.7.1",
"0.7.2",
"0.7.3",
"0.7.4",
"0.7.5",
"0.7.6",
"0.7.7",
"0.7.8",
"0.7.9",
"0.8.0",
"0.8.1",
"0.8.10",
"0.8.11",
"0.8.12",
"0.8.13",
"0.8.14",
"0.8.2",
"0.8.3",
"0.8.4",
"0.8.5",
"0.8.6",
"0.8.7",
"0.8.8",
"0.8.9",
"2.0.0",
"2.1.0",
"2.2.0",
"5.0.0",
"5.0.0.0b1",
"5.0.0.0b2",
"5.0.0.0b3",
"5.0.0.0rc1",
"5.0.0.0rc2",
"5.0.0.0rc3",
"5.1.0",
"5.2.0",
"5.3.0",
"5.3.1",
"5.3.10",
"5.3.11",
"5.3.12",
"5.3.13",
"5.3.2",
"5.3.3",
"5.3.4",
"5.3.5",
"5.3.6",
"5.3.7",
"5.3.8",
"5.3.9",
"6.0.0",
"6.0.0.0b1",
"6.0.0.0b2",
"6.0.0.0rc1",
"6.0.0.0rc2",
"6.1.0",
"6.2.0",
"6.2.1",
"6.2.10",
"6.2.11",
"6.2.12",
"6.2.13",
"6.2.14",
"6.2.15",
"6.2.16",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6",
"6.2.7",
"6.2.8",
"6.2.9",
"7.0.0",
"7.0.0.0b1",
"7.0.0.0b2",
"7.0.0.0b3",
"7.0.0.0rc1",
"7.0.0.0rc2",
"7.0.1",
"7.0.2",
"7.0.3",
"7.0.4",
"7.0.5"
]
}
],
"aliases": [
"CVE-2017-12155",
"GHSA-w8gx-hhcx-px6w"
],
"details": "A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions [7.0.6](https://github.com/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4) and [8.0.0](https://github.com/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30).",
"id": "PYSEC-2026-754",
"modified": "2026-07-06T07:37:29.524876Z",
"published": "2026-07-02T14:13:24.276345Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12155"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0602"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1593"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1627"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/tripleo/+bug/1720787"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489360"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/tripleo-heat-templates"
},
{
"type": "WEB",
"url": "https://opendev.org/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4"
},
{
"type": "WEB",
"url": "https://opendev.org/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/tripleo-heat-templates"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-w8gx-hhcx-px6w"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Openstack tripleo-heat-templates unauthenticated file access"
}
PYSEC-2026-623
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
Severity
6.1 (Medium)
Impacted products
| Name | purl | cobbler | pkg:pypi/cobbler |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cobbler",
"purl": "pkg:pypi/cobbler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.6.11-1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.3-2"
]
}
],
"aliases": [
"CVE-2016-9605",
"GHSA-4vc9-4xpq-77vm"
],
"details": "A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.",
"id": "PYSEC-2026-623",
"modified": "2026-07-06T07:36:25.412257Z",
"published": "2026-07-02T14:13:24.191314Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9605"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9605"
},
{
"type": "PACKAGE",
"url": "https://github.com/cobbler/cobbler"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/cobbler"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4vc9-4xpq-77vm"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Cobbler Arbitrary File Read"
}
PYSEC-2026-648
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.
Severity
8.8 (High)
Impacted products
| Name | purl | kallithea | pkg:pypi/kallithea |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "kallithea",
"purl": "pkg:pypi/kallithea"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0",
"0.1",
"0.2",
"0.2.1",
"0.2.2",
"0.2.9",
"0.2.99-pre",
"0.3",
"0.3.1"
]
}
],
"aliases": [
"CVE-2016-3691",
"GHSA-799h-qr84-pcrp"
],
"details": "Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.",
"id": "PYSEC-2026-648",
"modified": "2026-07-06T07:36:40.141579Z",
"published": "2026-07-02T14:13:24.113671Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3691"
},
{
"type": "PACKAGE",
"url": "https://github.com/NexMirror/Kallithea"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/02/3"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/kallithea"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-799h-qr84-pcrp"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Kallithea Routes CSRF Bypass"
}
PYSEC-2026-653
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3621",
"GHSA-8v8f-vc72-pmhc"
],
"details": "The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by \"$(admin_token)\" in the publicurl endpoint field.",
"id": "PYSEC-2026-653",
"modified": "2026-07-02T14:13:23.972537Z",
"published": "2026-07-02T14:13:23.972537Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3621"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/2989ff257e4fde6a168e25b926805e700406aa80"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/52714633c9a4dae5e60279217090859aa6dbcb4f"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1688"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1789"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1790"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2014-3621"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1354208"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139937"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1688.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1789.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1790.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/09/16/10"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2406-1"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8v8f-vc72-pmhc"
}
],
"summary": "OpenStack Identity Keystone Exposure of Sensitive Information"
}
PYSEC-2026-654
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-0204",
"GHSA-c4p9-87h3-7vr4"
],
"details": "OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.",
"id": "PYSEC-2026-654",
"modified": "2026-07-02T14:13:23.908910Z",
"published": "2026-07-02T14:13:23.908910Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0204"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/729dcad7384ba66ee7494154969cdd7ae90d86ee"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/786af9829c5329a982e3451f77afebbfb21850bd"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/97dfd55ad1b40365754dcbfce856f7ffae280a44"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/f0eee2f3b48dd0cffb9f75e396da2d914925cba5"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1309228"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/94396"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/21/3"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-c4p9-87h3-7vr4"
}
],
"summary": "OpenStack Identity Keystone Improper Privilege Management"
}
PYSEC-2026-655
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "2011.3"
},
{
"fixed": "2014.1.5"
},
{
"introduced": "2014.2"
},
{
"fixed": "2014.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-3646",
"GHSA-jwpw-ppj5-7h4w"
],
"details": "OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.",
"id": "PYSEC-2026-655",
"modified": "2026-07-02T14:13:23.853843Z",
"published": "2026-07-02T14:13:23.853843Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3646"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1443598"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456"
},
{
"type": "WEB",
"url": "http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-jwpw-ppj5-7h4w"
}
],
"summary": "OpenStack Keystone Logs Passwords"
}
PYSEC-2026-649
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3476",
"GHSA-274v-r947-v34r"
],
"details": "OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.",
"id": "PYSEC-2026-649",
"modified": "2026-07-02T14:13:23.805823Z",
"published": "2026-07-02T14:13:23.805823Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3476"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1324592"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00031.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/57886"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59547"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/06/12/3"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/68026"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-274v-r947-v34r"
}
],
"summary": "OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege"
}
PYSEC-2026-651
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-2014",
"GHSA-7332-36h8-8jh8"
],
"details": "OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.",
"id": "PYSEC-2026-651",
"modified": "2026-07-02T14:13:23.743769Z",
"published": "2026-07-02T14:13:23.743769Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2014"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1098177"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1099025"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/84347"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-July/111914.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/53397"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/59936"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-7332-36h8-8jh8"
}
],
"summary": "OpenStack Identity (Keystone) Denial of Service"
}
PYSEC-2026-683
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.
Severity
8.1 (High)
Impacted products
| Name | purl | mysql-connector-python | pkg:pypi/mysql-connector-python |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mysql-connector-python",
"purl": "pkg:pypi/mysql-connector-python"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "8.0.19"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.0.5"
]
}
],
"aliases": [
"CVE-2019-2435",
"GHSA-v5rq-w2xm-7g5f"
],
"details": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. ",
"id": "PYSEC-2026-683",
"modified": "2026-07-06T07:36:56.292078Z",
"published": "2026-07-02T14:13:23.657489Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2435"
},
{
"type": "PACKAGE",
"url": "https://github.com/mysql/mysql-connector-python"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190118-0002"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00044.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00053.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106616"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/mysql-connector-python"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-v5rq-w2xm-7g5f"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Access Control in MySQL Connector Python"
}
PYSEC-2026-728
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:37
VLAI
Details
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
Severity
8.8 (High)
Impacted products
| Name | purl | openexr | pkg:pypi/openexr |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "openexr",
"purl": "pkg:pypi/openexr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.2",
"1.0.3",
"1.1.0",
"1.2.0",
"1.3.0",
"1.3.1",
"1.3.2",
"1.3.7",
"1.3.8",
"1.3.9"
]
}
],
"aliases": [
"CVE-2017-9111",
"GHSA-qxh9-r8xw-7v99"
],
"details": "In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.",
"id": "PYSEC-2026-728",
"modified": "2026-07-06T07:37:05.482501Z",
"published": "2026-07-02T14:13:23.487285Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9111"
},
{
"type": "WEB",
"url": "https://github.com/openexr/openexr/issues/232"
},
{
"type": "WEB",
"url": "https://github.com/openexr/openexr/pull/233"
},
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/openexr"
},
{
"type": "WEB",
"url": "https://github.com/openexr/openexr/releases/tag/v2.2.1"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4148-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4339-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4755"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00060.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00000.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/05/12/5"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/openexr"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qxh9-r8xw-7v99"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenEXR invalid write"
}
PYSEC-2026-727
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:37
VLAI
Details
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
Severity
6.5 (Medium)
Impacted products
| Name | purl | openexr | pkg:pypi/openexr |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "openexr",
"purl": "pkg:pypi/openexr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.2",
"1.0.3",
"1.1.0",
"1.2.0",
"1.3.0",
"1.3.1",
"1.3.2",
"1.3.7",
"1.3.8",
"1.3.9"
]
}
],
"aliases": [
"CVE-2017-9112",
"GHSA-8m57-j273-2qg9"
],
"details": "In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.",
"id": "PYSEC-2026-727",
"modified": "2026-07-06T07:37:05.323674Z",
"published": "2026-07-02T14:13:23.364469Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9112"
},
{
"type": "WEB",
"url": "https://github.com/openexr/openexr/issues/232"
},
{
"type": "WEB",
"url": "https://github.com/openexr/openexr/pull/233"
},
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/openexr"
},
{
"type": "WEB",
"url": "https://github.com/openexr/openexr/releases/tag/v2.2.1"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4148-1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/05/12/5"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/openexr"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8m57-j273-2qg9"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenEXR invalid read"
}
PYSEC-2026-642
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.
Impacted products
| Name | purl | horizon | pkg:pypi/horizon |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon",
"purl": "pkg:pypi/horizon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3473",
"GHSA-8vwv-2v7v-jmgr"
],
"details": "Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.",
"id": "PYSEC-2026-642",
"modified": "2026-07-02T14:13:23.188473Z",
"published": "2026-07-02T14:13:23.188473Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3473"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/c844bd692894353c60b320005b804970605e910f"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/de4466d88b816437fb29eff5ab23b9b964cd3985"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:0939"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1188"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2014-3473"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/1308727"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
},
{
"type": "PACKAGE",
"url": "https://opendev.org/openstack/horizon"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/07/08/6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/68459"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/horizon"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8vwv-2v7v-jmgr"
}
],
"summary": "Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name"
}
PYSEC-2026-644
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
Impacted products
| Name | purl | horizon | pkg:pypi/horizon |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon",
"purl": "pkg:pypi/horizon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3474",
"GHSA-j57p-g33w-95c5"
],
"details": "Cross-site scripting (XSS) vulnerability in `horizon/static/horizon/js/horizon.instances.js` in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.",
"id": "PYSEC-2026-644",
"modified": "2026-07-02T14:13:23.115590Z",
"published": "2026-07-02T14:13:23.115590Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3474"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/32a7b713468161282f2ea01d5e2faff980d924cd"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/c844bd692894353c60b320005b804970605e910f"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/de4466d88b816437fb29eff5ab23b9b964cd3985"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:0939"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1188"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2014-3474"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/1322197"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
},
{
"type": "PACKAGE",
"url": "https://opendev.org/openstack/horizon"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/horizon/+/105476"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/105477"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/07/08/6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/68460"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/horizon"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-j57p-g33w-95c5"
}
],
"summary": "OpenStack Horizon Cross-site scripting (XSS) vulnerability"
}
PYSEC-2026-641
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.
Impacted products
| Name | purl | horizon | pkg:pypi/horizon |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon",
"purl": "pkg:pypi/horizon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3594",
"GHSA-8g68-2hcj-h8vg"
],
"details": "Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.",
"id": "PYSEC-2026-641",
"modified": "2026-07-02T14:13:23.057018Z",
"published": "2026-07-02T14:13:23.057018Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3594"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/ba2c98aea0db0d03200c811b86b3efe8367f3905"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/ba908ae88d5925f4f6783eb234cc4ea95017472b"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1188"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1335"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2014:1336"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2014-3594"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/1349491"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129774"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95378"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/115310"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/115311"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/115313"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1335.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1336.html"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2014/q3/413"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/69291"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/horizon"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8g68-2hcj-h8vg"
}
],
"summary": "OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface"
}
PYSEC-2026-646
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
Severity
7.5 (High)
Impacted products
| Name | purl | ironic | pkg:pypi/ironic |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ironic",
"purl": "pkg:pypi/ironic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.5"
},
{
"introduced": "5.0"
},
{
"fixed": "5.1.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0"
]
}
],
"aliases": [
"CVE-2016-4985",
"GHSA-f7cr-7c2c-fm8r"
],
"details": "The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the `v1/drivers/$DRIVER_NAME/vendor_passthru` resource.",
"id": "PYSEC-2026-646",
"modified": "2026-07-06T07:36:39.064327Z",
"published": "2026-07-02T14:13:22.984032Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4985"
},
{
"type": "WEB",
"url": "https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410"
},
{
"type": "WEB",
"url": "https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e"
},
{
"type": "WEB",
"url": "https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1377"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1378"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2016-4985"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ironic/+bug/1572796"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1346193"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/ironic"
},
{
"type": "WEB",
"url": "https://review.openstack.org/332195"
},
{
"type": "WEB",
"url": "https://review.openstack.org/332196"
},
{
"type": "WEB",
"url": "https://review.openstack.org/332197"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/06/21/6"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/ironic"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f7cr-7c2c-fm8r"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor"
}
PYSEC-2026-643
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Severity
5.4 (Medium)
Impacted products
| Name | purl | horizon | pkg:pypi/horizon |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon",
"purl": "pkg:pypi/horizon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.2"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-4428",
"GHSA-grm6-x6mr-q3cv"
],
"details": "Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.",
"id": "PYSEC-2026-643",
"modified": "2026-07-02T14:13:22.820828Z",
"published": "2026-07-02T14:13:22.820828Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4428"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1268"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1269"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1270"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1271"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1272"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2016-4428"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/1567673"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1343982"
},
{
"type": "WEB",
"url": "https://review.openstack.org/329996"
},
{
"type": "WEB",
"url": "https://review.openstack.org/329997"
},
{
"type": "WEB",
"url": "https://review.openstack.org/329998"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2016-010.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3617"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/06/17/4"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/horizon"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-grm6-x6mr-q3cv"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability"
}
PYSEC-2026-645
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
Severity
6.4 (Medium)
Impacted products
| Name | purl | instack-undercloud | pkg:pypi/instack-undercloud |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "instack-undercloud",
"purl": "pkg:pypi/instack-undercloud"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.2.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.1.dev90",
"4.1.0",
"4.2.0",
"4.2.1",
"5.0.0",
"5.0.0.0b1",
"5.0.0.0b2",
"5.0.0.0b3",
"5.0.0.0rc1",
"5.0.0.0rc2",
"5.0.0.0rc3",
"5.1.0",
"5.2.0",
"5.3.0",
"5.3.1",
"5.3.10",
"5.3.2",
"5.3.3",
"5.3.4",
"5.3.5",
"5.3.6",
"5.3.7",
"5.3.8",
"5.3.9",
"6.0.0",
"6.0.0.0b2",
"6.0.0.0rc1",
"6.0.0.0rc2",
"6.1.0",
"6.1.1",
"6.1.2",
"6.1.3",
"6.1.4",
"6.1.5",
"6.1.6",
"6.1.7",
"6.1.8",
"7.0.0",
"7.0.0.0b1",
"7.1.0",
"7.2.0"
]
}
],
"aliases": [
"CVE-2017-7549",
"GHSA-53wm-97p6-582f"
],
"details": "A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.",
"id": "PYSEC-2026-645",
"modified": "2026-07-06T07:36:38.105356Z",
"published": "2026-07-02T14:13:22.649014Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2557"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2649"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2687"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2693"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2726"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-7549"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1477403"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/instack/PYSEC-2017-152.yaml"
},
{
"type": "WEB",
"url": "https://opendev.org/openstack/instack-undercloud"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170907040549/http://www.securityfocus.com/bid/100407"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100407"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/instack-undercloud"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-53wm-97p6-582f"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "instack-undercloud vulnerable to symlink attack on tmp files"
}
PYSEC-2026-686
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-21 08:40
VLAI
Details
A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.
Severity
5.9 (Medium)
Impacted products
| Name | purl | neutron | pkg:pypi/neutron |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "neutron",
"purl": "pkg:pypi/neutron"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.0-12.1"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.3.0-11.1"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.3.1-2.1"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.2-1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.5",
"10.0.6",
"10.0.7",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"12.0.0",
"12.0.0.0b3",
"12.0.0.0rc1",
"12.0.0.0rc2",
"12.0.1",
"12.0.2",
"12.0.3",
"12.0.4",
"12.0.5",
"12.0.6",
"12.1.0",
"12.1.1",
"13.0.0",
"13.0.0.0b1",
"13.0.0.0b2",
"13.0.0.0b3",
"13.0.0.0rc1",
"13.0.0.0rc2",
"13.0.1",
"13.0.2",
"13.0.3",
"13.0.4",
"13.0.5",
"13.0.6",
"13.0.7",
"14.0.0",
"14.0.0.0b1",
"14.0.0.0b2",
"14.0.0.0b3",
"14.0.0.0rc1",
"14.0.1",
"14.0.2",
"14.0.3",
"14.0.4",
"14.1.0",
"14.2.0",
"14.3.0",
"14.3.1",
"14.4.0",
"14.4.1",
"14.4.2",
"15.0.0",
"15.0.0.0b1",
"15.0.0.0rc1",
"15.0.0.0rc2",
"15.0.1",
"15.0.2",
"15.1.0",
"15.2.0",
"15.3.0",
"15.3.1",
"15.3.2",
"15.3.3",
"15.3.4",
"16.0.0",
"16.0.0.0b1",
"16.0.0.0rc1",
"16.0.0.0rc2",
"16.1.0",
"16.2.0",
"16.3.0",
"16.3.1",
"16.3.2",
"16.4.0",
"16.4.1",
"16.4.2",
"17.0.0",
"17.0.0.0rc1",
"17.0.0.0rc2",
"17.1.0",
"17.1.1",
"17.1.2",
"17.2.0",
"17.2.1",
"17.3.0",
"17.4.0",
"17.4.1",
"18.0.0",
"18.0.0.0rc1",
"18.0.0.0rc2",
"18.1.0",
"18.1.1",
"18.2.0",
"18.3.0",
"18.4.0",
"18.5.0",
"18.6.0",
"19.0.0",
"19.0.0.0rc1",
"19.0.0.0rc2",
"19.1.0",
"19.2.0",
"19.3.0",
"19.4.0",
"19.5.0",
"19.6.0",
"19.7.0",
"20.0.0",
"20.0.0.0rc1",
"20.0.0.0rc2",
"20.1.0",
"20.2.0",
"20.3.0",
"20.3.1",
"20.4.0",
"20.5.0",
"21.0.0",
"21.0.0.0rc1",
"21.0.0.0rc2",
"21.1.0",
"21.1.1",
"21.1.2",
"21.2.0",
"21.2.1",
"22.0.0",
"22.0.0.0rc1",
"22.0.0.0rc2",
"22.0.1",
"22.0.2",
"22.1.0",
"22.2.0",
"22.2.1",
"23.0.0",
"23.0.0.0b1",
"23.0.0.0b2",
"23.0.0.0b3",
"23.0.0.0rc1",
"23.0.0.0rc2",
"23.1.0",
"23.2.0",
"23.3.0",
"23.4.0",
"23.5.0",
"24.0.0",
"24.0.0.0b1",
"24.0.0.0rc1",
"24.0.0.0rc2",
"24.0.1",
"24.1.0",
"24.2.0",
"24.2.1",
"24.2.2",
"25.0.0",
"25.0.0.0b1",
"25.0.0.0rc1",
"25.0.0.0rc2",
"25.1.0",
"25.2.0",
"25.2.1",
"25.2.2",
"25.2.3",
"26.0.0",
"26.0.0.0b1",
"26.0.0.0b2",
"26.0.0.0rc1",
"26.0.0.0rc2",
"26.0.1",
"26.0.2",
"26.0.3",
"26.0.4",
"27.0.0",
"27.0.0.0b1",
"27.0.0.0rc1",
"27.0.1",
"27.0.2",
"27.0.3",
"28.0.0",
"28.0.0.0b1",
"28.0.0.0b2",
"28.0.0.0rc1",
"28.0.0.0rc2",
"28.0.1",
"29.0.0.0b1",
"26.0.5"
]
}
],
"aliases": [
"CVE-2017-7543",
"GHSA-hvxr-2fvv-c3wq"
],
"details": "A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.",
"id": "PYSEC-2026-686",
"modified": "2026-07-21T08:40:34.960792Z",
"published": "2026-07-02T14:13:22.484803Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7543"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2447"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2448"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2449"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2450"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2451"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2452"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-7543"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1473792"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543"
},
{
"type": "PACKAGE",
"url": "https://opendev.org/openstack/neutron"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227153412/https://www.securityfocus.com/bid/100237"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/neutron"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hvxr-2fvv-c3wq"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Neutron Race Condition vulnerability"
}
PYSEC-2026-662
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:36
VLAI
Details
Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
Severity
5.4 (Medium)
Impacted products
| Name | purl | manila-ui | pkg:pypi/manila-ui |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "manila-ui",
"purl": "pkg:pypi/manila-ui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"1.0.0",
"1.0.1",
"1.1.0",
"1.2.0",
"2.0.0",
"2.1.0",
"2.2.0",
"2.3.0",
"2.4.0",
"2.5.0"
]
}
],
"aliases": [
"CVE-2016-6519",
"GHSA-vq76-5ghr-9p4v"
],
"details": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.",
"id": "PYSEC-2026-662",
"modified": "2026-07-06T07:36:50.232710Z",
"published": "2026-07-02T14:13:22.326003Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
},
{
"type": "WEB",
"url": "https://github.com/openstack/manila-ui/commit/009913d725bee34cef0bd62e47a298025ace2696"
},
{
"type": "WEB",
"url": "https://github.com/openstack/manila-ui/commit/89593686ef18f2bd06223b92071b4be2362a5abd"
},
{
"type": "WEB",
"url": "https://github.com/openstack/manila-ui/commit/fca19a1b0d42536644212c5d673fbd6866e67c43"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/manila-ui/+bug/1597738"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2115.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2116.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2117.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/09/15/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93001"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/manila-ui"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-vq76-5ghr-9p4v"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Openstack Manila Persistent XSS in Metadata field"
}
PYSEC-2026-750
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:37
VLAI
Details
Pypi package scout-browser (GitHub repository clinical-genomics/scout) prior to v4.52 is vulnerable to server-side request forgery. An attacker could make the application perform arbitrary requests to steal cookies, request access to private areas, or lead to cross-site scripting.
Severity
8.2 (High)
Impacted products
| Name | purl | scout-browser | pkg:pypi/scout-browser |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "scout-browser",
"purl": "pkg:pypi/scout-browser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.52"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.2.0",
"1.2.0b1",
"1.2.0b2",
"1.4.0",
"2.0.0",
"3.0.2",
"3.0.3",
"3.0.5",
"3.0.6",
"3.0.7",
"3.3.1",
"3.5.0",
"4.0.0",
"4.1.0",
"4.1.1",
"4.1.2",
"4.1.3",
"4.1.4",
"4.10.1",
"4.11",
"4.12.3",
"4.12.4",
"4.13.1",
"4.14",
"4.14.1",
"4.15",
"4.15.1",
"4.16.1",
"4.18",
"4.2.1",
"4.2.2",
"4.21",
"4.21.1",
"4.21.2",
"4.22",
"4.23",
"4.24",
"4.24.1",
"4.25",
"4.26",
"4.26.1",
"4.27",
"4.28",
"4.29",
"4.29.1",
"4.3.0",
"4.3.1",
"4.30",
"4.30.1",
"4.30.2",
"4.31",
"4.31.1",
"4.32",
"4.32.1",
"4.33",
"4.33.1",
"4.34",
"4.35",
"4.36",
"4.37",
"4.38",
"4.39",
"4.4.1",
"4.40",
"4.40.1",
"4.41",
"4.42",
"4.42.1",
"4.43",
"4.43.1",
"4.44",
"4.45",
"4.46",
"4.46.1",
"4.47",
"4.48",
"4.48.1",
"4.49",
"4.50",
"4.50.1",
"4.51",
"4.7",
"4.7.2",
"4.7.3",
"4.8.0",
"4.8.2",
"4.8.3",
"4.9.0"
]
}
],
"aliases": [
"CVE-2022-1592",
"GHSA-g53g-q539-93cv"
],
"details": "Pypi package scout-browser (GitHub repository clinical-genomics/scout) prior to v4.52 is vulnerable to server-side request forgery. An attacker could make the application perform arbitrary requests to steal cookies, request access to private areas, or lead to cross-site scripting.",
"id": "PYSEC-2026-750",
"modified": "2026-07-06T07:37:25.240621Z",
"published": "2026-07-02T14:13:22.170189Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1592"
},
{
"type": "WEB",
"url": "https://github.com/Clinical-Genomics/scout/issues/3325"
},
{
"type": "WEB",
"url": "https://github.com/Clinical-Genomics/scout/pull/3326"
},
{
"type": "WEB",
"url": "https://github.com/clinical-genomics/scout/commit/b0ef15f4737d0c801154c1991b52ff5cab4f5c83"
},
{
"type": "PACKAGE",
"url": "https://github.com/clinical-genomics/scout"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/352b39da-0f2e-415a-9793-5480cae8bd27"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/scout-browser"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-g53g-q539-93cv"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Server-Side Request Forgery in scout-browser"
}
PYSEC-2026-652
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-0282",
"GHSA-8833-qrvm-wc3h"
],
"details": "OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.",
"id": "PYSEC-2026-652",
"modified": "2026-07-02T14:13:22.090672Z",
"published": "2026-07-02T14:13:22.090672Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0282"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/7402f5ef994599653bdbb3ed5ff1a2b8c3e72b9f"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/9572bfc393f66f5ce3b44c0a77a9e29cc0374c6f"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/f0b4d300db5cc61d4f079f8bce9da8e8bea1081a"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1121494"
},
{
"type": "WEB",
"url": "https://launchpad.net/keystone/+milestone/2012.2.4"
},
{
"type": "WEB",
"url": "https://launchpad.net/keystone/grizzly/2013.1"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/22319"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/22320"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/22321"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/02/19/3"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8833-qrvm-wc3h"
}
],
"summary": "OpenStack Keystone allows context-dependent attackers to bypass access restrictions"
}
PYSEC-2026-650
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.
Severity
6.5 (Medium)
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-0270",
"GHSA-4ppj-4p4v-jf4p"
],
"details": "OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.",
"id": "PYSEC-2026-650",
"modified": "2026-07-02T14:13:22.017502Z",
"published": "2026-07-02T14:13:22.017502Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0270"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2013-0270"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1099025"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909012"
},
{
"type": "WEB",
"url": "https://launchpad.net/keystone/grizzly/2013.1"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0708.html"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4ppj-4p4v-jf4p"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Keystone Denial of Service vulnerability via a large HTTP request"
}
PYSEC-2026-748
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-06 07:37
VLAI
Details
SaltStack RSA Key Generation allows remote users to decrypt communications
Severity
8.1 (High)
Impacted products
| Name | purl | salt | pkg:pypi/salt |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt",
"purl": "pkg:pypi/salt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.15.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.10.0",
"0.10.1",
"0.10.2",
"0.10.3",
"0.10.4",
"0.10.5",
"0.11.0",
"0.11.1",
"0.12.0",
"0.12.1",
"0.13.0",
"0.13.1",
"0.13.2",
"0.13.3",
"0.14.0",
"0.14.1",
"0.15.0",
"0.8.7",
"0.8.9",
"0.9.0",
"0.9.1",
"0.9.2",
"0.9.3",
"0.9.4",
"0.9.5",
"0.9.6",
"0.9.7",
"0.9.8",
"0.9.9",
"0.9.9.1"
]
}
],
"aliases": [
"CVE-2013-2228",
"GHSA-gq26-cpq6-w85r"
],
"details": "SaltStack RSA Key Generation allows remote users to decrypt communications",
"id": "PYSEC-2026-748",
"modified": "2026-07-06T07:37:24.622995Z",
"published": "2026-07-02T14:13:21.938484Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2228"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-2228"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2228"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85372"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-2228"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/07/01/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/60868"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1028717"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/salt"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-gq26-cpq6-w85r"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SaltStack RSA Key Generation allows remote users to decrypt communications"
}
PYSEC-2026-656
Vulnerability from pysec - Published: 2026-07-02 14:13 - Updated: 2026-07-02 14:13
VLAI
Details
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
Severity
5.9 (Medium)
Impacted products
| Name | purl | keystone | pkg:pypi/keystone |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone",
"purl": "pkg:pypi/keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-2255",
"GHSA-qh2x-hpf9-cf2g"
],
"details": "HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.",
"id": "PYSEC-2026-656",
"modified": "2026-07-02T14:13:21.847931Z",
"published": "2026-07-02T14:13:21.847931Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2255"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/0f9652d92e175a1f7dc3c2a37ab444b8f189375a"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/5bd4c2984d329625a2a8442b316fa235dbb88a3d"
},
{
"type": "WEB",
"url": "https://github.com/openstack/neutron/commit/7255e056092f034daaeb4246a812900645d46911"
},
{
"type": "WEB",
"url": "https://github.com/openstack/python-keystoneclient/commit/20e166fd8a943ee3f91ba362a47e9c14c7cc5f4c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2013-2255"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ossn/+bug/1188189"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2255"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2255"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85562"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-2255"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229073508/https://www.securityfocus.com/bid/61118"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/keystone"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qh2x-hpf9-cf2g"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Keystone and other components vulnerable to Improper Certificate Validation"
}