rhsa-2014_0939
Vulnerability from csaf_redhat
Published
2014-07-24 17:21
Modified
2024-11-22 08:17
Summary
Red Hat Security Advisory: python-django-horizon security, bug fix, and enhancement update

Notes

Topic
Updated python-django-horizon packages that fix three security issues, multiple bugs, and add an enhancement are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
OpenStack Dashboard (Horizon) provides administrators and users with a graphical interface to access, provision, and automate cloud-based resources. A cross-site scripting (XSS) flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform XSS attacks against other Horizon users. (CVE-2014-3473) It was found that network names were not sanitized. A malicious user could use this flaw to perform XSS attacks against other Horizon users by creating a network with a specially crafted name. (CVE-2014-3474) It was found that certain email addresses were not sanitized. An administrator could use this flaw to perform XSS attacks against other Horizon users by storing an email address that has a specially crafted name. (CVE-2014-3475) Red Hat would like to thank the OpenStack project for reporting these issues. Upstream acknowledges Jason Hullinger from Hewlett Packard as the original reporter of CVE-2014-3473, Craig Lorentzen from Cisco as the original reporter of CVE-2014-3474, and Michael Xin from Rackspace as the original reporter of CVE-2014-3475. This update also fixes the following bugs: * The python-django-horizon package has been updated to upstream version 2014.1.1. This includes several important bug fixes, including an issue that prevented access to Swift pseudo-folders through the Dashboard, and an issue that prevented instances from being launched when using the French locale (or other locales that use apostrophes). (BZ#1117901) Lastly, this update also adds the following enhancement: * A new "Update" option has been added for OpenStack Networking VPNaaS support for Dashboard. This makes it easier to use Virtual Private Network as a Service (VPNaaS). (BZ#1042030) All python-django-horizon users are advised to upgrade to these updated packages, which correct these issues and add this enhancement.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated python-django-horizon packages that fix three security issues,\nmultiple bugs, and add an enhancement are now available for Red Hat\nEnterprise Linux OpenStack Platform 5.0 (Icehouse) for Red Hat Enterprise\nLinux 7.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack Dashboard (Horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nA cross-site scripting (XSS) flaw was found in the way orchestration\ntemplates were handled. An owner of such a template could use this flaw to\nperform XSS attacks against other Horizon users. (CVE-2014-3473)\n\nIt was found that network names were not sanitized. A malicious user could\nuse this flaw to perform XSS attacks against other Horizon users by\ncreating a network with a specially crafted name. (CVE-2014-3474)\n\nIt was found that certain email addresses were not sanitized. An\nadministrator could use this flaw to perform XSS attacks against other\nHorizon users by storing an email address that has a specially crafted\nname. (CVE-2014-3475)\n\nRed Hat would like to thank the OpenStack project for reporting these\nissues. Upstream acknowledges Jason Hullinger from Hewlett Packard as the\noriginal reporter of CVE-2014-3473, Craig Lorentzen from Cisco as the\noriginal reporter of CVE-2014-3474, and Michael Xin from Rackspace as the\noriginal reporter of CVE-2014-3475.\n\nThis update also fixes the following bugs:\n\n* The python-django-horizon package has been updated to upstream version\n2014.1.1. This includes several important bug fixes, including an issue\nthat prevented access to Swift pseudo-folders through the Dashboard, and\nan issue that prevented instances from being launched when using the French\nlocale (or other locales that use apostrophes). (BZ#1117901)\n\nLastly, this update also adds the following enhancement:\n\n* A new \"Update\" option has been added for OpenStack Networking VPNaaS\nsupport for Dashboard. This makes it easier to use Virtual Private Network\nas a Service (VPNaaS). (BZ#1042030)\n\nAll python-django-horizon users are advised to upgrade to these updated\npackages, which correct these issues and add this enhancement.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0939",
        "url": "https://access.redhat.com/errata/RHSA-2014:0939"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1042030",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1042030"
      },
      {
        "category": "external",
        "summary": "1116090",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
      },
      {
        "category": "external",
        "summary": "1117901",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1117901"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0939.json"
      }
    ],
    "title": "Red Hat Security Advisory: python-django-horizon security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-22T08:17:42+00:00",
      "generator": {
        "date": "2024-11-22T08:17:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0939",
      "initial_release_date": "2014-07-24T17:21:49+00:00",
      "revision_history": [
        {
          "date": "2014-07-24T17:21:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-07-24T17:21:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:17:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
                "product": {
                  "name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
                  "product_id": "7Server-RH7-RHOS-5.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:5::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
                "product": {
                  "name": "openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
                  "product_id": "openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-dashboard-theme@2014.1.1-2.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
                "product": {
                  "name": "openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
                  "product_id": "openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-dashboard@2014.1.1-2.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch",
                "product": {
                  "name": "python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch",
                  "product_id": "python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-django-horizon-doc@2014.1.1-2.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-django-horizon-0:2014.1.1-2.el7ost.noarch",
                "product": {
                  "name": "python-django-horizon-0:2014.1.1-2.el7ost.noarch",
                  "product_id": "python-django-horizon-0:2014.1.1-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-django-horizon@2014.1.1-2.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-django-horizon-0:2014.1.1-2.el7ost.src",
                "product": {
                  "name": "python-django-horizon-0:2014.1.1-2.el7ost.src",
                  "product_id": "python-django-horizon-0:2014.1.1-2.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-django-horizon@2014.1.1-2.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-dashboard-0:2014.1.1-2.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch"
        },
        "product_reference": "openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch"
        },
        "product_reference": "openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-django-horizon-0:2014.1.1-2.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch"
        },
        "product_reference": "python-django-horizon-0:2014.1.1-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-django-horizon-0:2014.1.1-2.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src"
        },
        "product_reference": "python-django-horizon-0:2014.1.1-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
        },
        "product_reference": "python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-5.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack project"
          ]
        },
        {
          "names": [
            "Jason Hullinger"
          ],
          "organization": "Hewlett Packard",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Craig Lorentzen"
          ],
          "organization": "Cisco",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Michael Xin"
          ],
          "organization": "Rackspace",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2014-3473",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-06-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1116090"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-horizon: multiple XSS flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
          "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3473"
        },
        {
          "category": "external",
          "summary": "RHBZ#1116090",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3473",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3473"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3473",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3473"
        }
      ],
      "release_date": "2014-07-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-07-24T17:21:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0939"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-horizon: multiple XSS flaws"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack project"
          ]
        },
        {
          "names": [
            "Jason Hullinger"
          ],
          "organization": "Hewlett Packard",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Craig Lorentzen"
          ],
          "organization": "Cisco",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Michael Xin"
          ],
          "organization": "Rackspace",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2014-3474",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-06-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1116090"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-horizon: multiple XSS flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
          "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3474"
        },
        {
          "category": "external",
          "summary": "RHBZ#1116090",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3474",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3474"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3474",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3474"
        }
      ],
      "release_date": "2014-07-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-07-24T17:21:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0939"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-horizon: multiple XSS flaws"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack project"
          ]
        },
        {
          "names": [
            "Jason Hullinger"
          ],
          "organization": "Hewlett Packard",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Craig Lorentzen"
          ],
          "organization": "Cisco",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Michael Xin"
          ],
          "organization": "Rackspace",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2014-3475",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-06-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1116090"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-horizon: multiple XSS flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
          "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3475"
        },
        {
          "category": "external",
          "summary": "RHBZ#1116090",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3475",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3475"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3475",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3475"
        }
      ],
      "release_date": "2014-07-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-07-24T17:21:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0939"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-horizon: multiple XSS flaws"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack project"
          ]
        },
        {
          "names": [
            "Jason Hullinger"
          ],
          "organization": "Hewlett Packard",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Craig Lorentzen"
          ],
          "organization": "Cisco",
          "summary": "Acknowledged by upstream."
        },
        {
          "names": [
            "Michael Xin"
          ],
          "organization": "Rackspace",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2014-8578",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-06-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1116090"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-horizon: multiple XSS flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
          "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
          "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-8578"
        },
        {
          "category": "external",
          "summary": "RHBZ#1116090",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116090"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-8578",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-8578"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8578",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8578"
        }
      ],
      "release_date": "2014-07-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-07-24T17:21:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0939"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOS-5.0:openstack-dashboard-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:openstack-dashboard-theme-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.noarch",
            "7Server-RH7-RHOS-5.0:python-django-horizon-0:2014.1.1-2.el7ost.src",
            "7Server-RH7-RHOS-5.0:python-django-horizon-doc-0:2014.1.1-2.el7ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-horizon: multiple XSS flaws"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.