Multiple SQL injection vulnerabilities in app/models/concerns/hostcommon.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.

app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.

The (1) power and (2) ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.

Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.

Jaroslav Henner (jhenner) reports:

When console-log is run often enough, it seems to be causing death of nova-compute.

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

+++ This bug was initially created as a clone of Bug #957481 +++

Some potential issues discovered whilst auditing openstack & dependencies for tempfile vulnerabilities.

Warning: nagios-3.4.4-1.el6ost/nagios/html/rss-newsfeed.php

define('MAGPIECACHEDIR', '/tmp/magpiecache');

Magpie RSS cache dir is set to a fixed location in /tmp. The cached RSS content is then used to build html content that could be served to an end user.

Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the UsersController controller.

The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.

def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end

Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

+++ This bug was initially created as a clone of Bug #958002 +++

+++ This bug was initially created as a clone of Bug #957481 +++

Warning: nagios-3.4.4-1.el6ost/nagios.upgradetov3.sh

Tempfile is created by using $$ should use mktemp instead.

tmp1=/tmp/nagioscfg.$$.tmp

--- Additional comment from Kurt Seifried on 2013-04-30 03:19:10 EDT ---

nagios.upgradetov3.sh is not in upstreams files, it's added by Red Hat and several other vendors. So splitting this bug again.

openstack-utils openstack-db has insecure password creation