The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0983 advisory.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines, creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * novnc allows open redirection (CVE-2021-3654)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5866-1 advisory.

  - An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It     can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain     tokens used for console access. All Nova setups using novncproxy are affected. This is related to     NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py. (CVE-2015-9543)

  - An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and     reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS     header, resulting in a denial of service attack on the compute host. (The same code error also results in     data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups     supporting encrypted volumes are affected. (CVE-2017-18191)

  - An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x     before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live     migration, a user may gain access to destination host devices that share the same paths as host devices     previously referenced by the virtual machine on the source host. This can include block devices that map     to different Cinder volumes at the destination than at the source. Only deployments allowing host-based     connections (for instance, root and ephemeral devices) are affected. (CVE-2020-17376)

  - A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC     could be made to redirect to any desired URL. (CVE-2021-3654)

  - An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By     creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then     changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service     to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-     IOV are affected. (CVE-2022-37394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202305-02 (Python, PyPy3: Multiple Vulnerabilities)

  - In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands     discovered in the system mailcap file. This may allow attackers to inject shell commands into applications     that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or     arguments). The fix is also back-ported to 3.7, 3.8, 3.9 (CVE-2015-20107)

  - A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC     could be made to redirect to any desired URL. (CVE-2021-3654)

  - The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases     involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given     via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different     servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
    (CVE-2021-28363)

  - ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to     no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
    NOTE: this is disputed by a third party because the http.server.html documentation page states Warning:
    http.server is not recommended for production. It only implements basic security checks. (CVE-2021-28861)

  - In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP     address string. This (in some situations) allows attackers to bypass access control that is based on IP     addresses. (CVE-2021-29921)

  - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform     Resource Locator (URL) strings into components. The issue involves how the urlparse method does not     sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to     input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1,     3.9.5, 3.8.11, 3.7.11 and 3.6.14. (CVE-2022-0391)

  - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer     overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.
    This occurs in the sponge function interface. (CVE-2022-37454)

  - Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-     default configuration. The Python multiprocessing library, when used with the forkserver start method on     Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which     in many system configurations means any user on the same machine. Pickles can execute arbitrary code.
    Thus, this allows for local user privilege escalation to the user that any forkserver process is running     as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start     method for multiprocessing is not the default start method. This issue is Linux specific because only     Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract     namespace sockets by default. Support for users manually specifying an abstract namespace socket was added     as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do     that in CPython before 3.9. (CVE-2022-42919)

  - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path     when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name     being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by     remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger     excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
    For example, the attack payload could be placed in the Location header of an HTTP response with status     code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0999 advisory.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * novnc allows open redirection (CVE-2021-3654)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

    Bug Fix(es):

    * Red Hat OpenStack Platform (RHOSP) does not support the use of a fully qualified domain name (FQDN) as     the instance display name in a boot server request. The instance display name is passed from the boot     server request to the `instance.hostname` field. Some customers use this unsupported naming in their     workflows.

    A recent update [1] now sanitizes the `instance.hostname` field. The sanitization steps include replacing     periods with dashes, a replacement that makes it impossible to continue using the unsupported FQDN     instance display names.

    This update provides a temporary workaround for customers who use a fully qualified domain name (FQDN) as     the instance display name in a boot server request. It limits the scope of the sanitization to cases where     the instance display name ends with a period followed by one or more numeric digits.

    If you use FQDN as the instance display name in a boot server request, modify your workflow before     upgrading to RHOSP 17. (BZ#2036652)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
159218	RHEL 8 : Red Hat OpenStack Platform 16.1 (openstack-nova) (RHSA-2022:0983)	Nessus	Red Hat Local Security Checks	3/25/2022	6/4/2024	medium
171386	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Nova vulnerabilities (USN-5866-1)	Nessus	Ubuntu Local Security Checks	2/13/2023	10/16/2023	high
175043	GLSA-202305-02 : Python, PyPy3: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	5/3/2023	5/3/2023	critical
159196	RHEL 8 : Red Hat OpenStack Platform 16.2 (openstack-nova) (RHSA-2022:0999)	Nessus	Red Hat Local Security Checks	3/24/2022	6/4/2024	medium

Detections

Analytics

Plugins Search

medium

high

critical

medium