Grant Murphy

Commented bugs

Critical

Fix Committed

#1321080 [OSSA 2014-021] auth token is exposed in meter http.request (CVE-2014-4615)

Ceilometer icehouse 266

Critical

Fix Committed

#1321080 [OSSA 2014-021] auth token is exposed in meter http.request (CVE-2014-4615)

oslo-incubator havana 266

Critical

Fix Committed

#1398830 [OSSA 2015-003] Glance image leak when in saving state (CVE-2014-9623)

Glance juno 296

Critical

Confirmed

#1546507 Regular user in non-default non-recommended configuration can delete any image file

Glance 42

Critical

Confirmed

#1546507 Regular user in non-default non-recommended configuration can delete any image file

Glance liberty 42

Critical

Confirmed

#1546507 Regular user in non-default non-recommended configuration can delete any image file

Glance ocata 42

Critical

Confirmed

#1546507 Regular user in non-default non-recommended configuration can delete any image file

Glance newton 42

Critical

Confirmed

#1546507 Regular user in non-default non-recommended configuration can delete any image file

Glance mitaka 42

High

In Progress

#1269418 [OSSA 2014-017] nova rescue doesn't put VM into RESCUE status on vmware (CVE-2014-2573)

VMwareAPI-Team 266

High

Triaged

#1479385 Cause conflicts within glance public metadefs

Glance 22

High

Fix Committed

#1477910 A user can prevent another user listing images via v2 (in certain cases)

Glance Client kilo 266

High

Confirmed

#1563954 use_forwarded_for exposes metadata

OpenStack Compute (nova) 10

High

Confirmed

#1572719 Client may hold socket open after ChunkWriteTimeout

OpenStack Object Storage (swift) 26

Medium

Triaged

#1343657 Shell Injection in backup strategies

OpenStack DBaaS (Trove) 20

Medium

New

#1417762 XSS in network create error reporting

OpenStack Dashboard (Horizon) 12

Medium

Triaged

#1434545 Several command injection vulnerabilities in guestagent/pkg

OpenStack DBaaS (Trove) 10

Medium

Confirmed

#1482095 Vagrant wants older Virtualbox than is available in the repositories

vagrant (Ubuntu) 20

Medium

Fix Committed

#1449062 [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)

python-oslo.concurrency (Ubuntu Wily) 282

Medium

Fix Committed

#1449062 [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)

Ubuntu Cloud Archive liberty 282

Medium

Fix Committed

#1449062 [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)

Ubuntu Cloud Archive mitaka 282

Low

Fix Committed

#1492140 [OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543)

OpenStack Compute (nova) rocky 272

Wishlist

In Progress

#1522524 User can delete deactivated images

Glance 260

Undecided

Confirmed

#1267635 security issues in heat templates

Heat Templates 256

Undecided

Fix Committed

#1321080 [OSSA 2014-021] auth token is exposed in meter http.request (CVE-2014-4615)

oslo-incubator icehouse 266

Undecided

New

#1341954 suds client subject to cache poisoning by local attacker

gantt 262

Undecided

Fix Committed

#1378450 [OSSA 2014-039] Maliciously crafted dns_nameservers will crash neutron (CVE-2014-7821)

neutron icehouse 274

Undecided

Fix Committed

#1399172 [OSSA 2015-001] L3 agent DoS vulnerability (CVE-2014-8153)

neutron juno 264

Undecided

Incomplete

#1417304 Upload/Import image continues consuming glance host cpu/memory/network/disk resources even after the image is deleted

Glance 16

Undecided

New

#1491077 iter_alternative_names doesn't honor fail_other_types

Anchor 6

Undecided

New

#1546507 Regular user in non-default non-recommended configuration can delete any image file

OpenStack Security Notes 42