RDO OpenStack RDO vulnerabilities

Latest RDO OpenStack RDO CVEs

Newest publication first

1. CVE-2023-3966 Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet

   Published 2024-02-22

   High·CVSS 7.5 EPSS 1.3%

   A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.

2. CVE-2023-1633 Insecure barbican configuration file leaking credential

   Published 2023-09-24

   Medium·CVSS 5.5 EPSS 0.19%

   A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.

3. CVE-2023-1636 Incomplete container isolation

   Published 2023-09-24

   Medium·CVSS 5.0 EPSS 0.48%

   A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any...

4. CVE-2023-1625 Information leak in api

   Published 2023-09-24

   Medium·CVSS 5.0 EPSS 0.72%

   An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.