Red Hat OpenStack Platform 16.2/rhosp-rhel8/openstack-keystone

Red Hat · Package

16 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M	dnspython Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9	PyPIRed Hat	High	Fix reported	2026-11-12
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review.	oauthlib Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9	PyPIRed Hat	Medium	Fix reported	2026-10-13
PyJWT: PyJWKClient follows redirects when fetching JWKSCVE-2026-102267 · GHSA-9V7F-9G4P-FFGJVersion ranges need review.	pyjwt Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9	PyPIRed Hat	High	Fix reported	2026-10-01
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review.	pyjwt Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9	PyPIRed Hat	Medium	No fix reported	2026-10-01
WebOb: Open redirect in Location header normalization via leading C0 control / space charactersCVE-2026-54770 · GHSA-6HX8-3WJJ-GR8GVersion ranges need review.	webob Red Hat Ceph Storage 4/python-webob	PyPIRed Hat	Medium	Fix reported	2026-09-10
sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-71491 · GHSA-F2FF-P2WW-7P4PVersion ranges need review.	sqlparse Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8	PyPIRed Hat	High	Fix reported	2026-09-10
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review.	sqlparse Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8	PyPIRed Hat	Medium	Fix reported	2026-09-10
OpenStack Keystone has an Incorrect Authorization issueCVE-2026-43000 · GHSA-Q623-F4J4-P4XJVersion ranges need review.	keystone Red Hat OpenStack Platform 16.2/openstack-keystone	PyPIRed Hat	Medium	Fix reported	2026-09-10
OpenStack Keystone has an Authorization BypassCVE-2026-42999 · GHSA-2R23-2G6V-2M5FVersion ranges need review.	keystone Red Hat OpenStack Platform 13 (Queens)/rhosp13/openstack-keystone	PyPIRed Hat	Medium	Fix reported	2026-09-10
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credentialCVE-2026-42998 · GHSA-8F8M-WRVR-WCVFVersion ranges need review.	keystone Red Hat OpenStack Platform 13 (Queens)/rhosp13/openstack-keystone	PyPIRed Hat	Medium	Fix reported	2026-09-10
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-59893 · GHSA-PRG7-HCFM-MFCRVersion ranges need review.	sqlparse Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8	PyPIRed Hat	High	Fix reported	2026-09-10
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-54284 · GHSA-PWGV-4X5Q-6M9FVersion ranges need review.	sqlparse Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8	PyPIRed Hat	High	Fix reported	2026-09-10
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued tokenCVE-2026-44394 · GHSA-WHQR-FGM5-X77QVersion ranges need review.	keystone Red Hat OpenStack Platform 13 (Queens)/rhosp13/openstack-keystone	PyPIRed Hat	Medium	Fix reported	2026-09-10
ironic: OpenStack Ironic: Information disclosure via crafted requestCVE-2026-71201	Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel8-operator Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel9-operator	Red Hat	Medium	No fix reported	Not recorded
keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listingsCVE-2026-80183	Red Hat OpenStack Platform 13 (Queens)/rhosp13/openstack-keystone Red Hat OpenStack Platform 16.2/openstack-keystone	Red Hat	Medium	No fix reported	Not recorded
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmissionCVE-2026-84782	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Compute Attestation/agent-sandbox/agent-sandbox-router	Red Hat	High	No fix reported	Not recorded