app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request.

Multiple SQL injection vulnerabilities in app/models/concerns/hostcommon.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.

openstack-utils openstack-db has insecure password creation

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

+++ This bug was initially created as a clone of Bug #958002 +++

+++ This bug was initially created as a clone of Bug #957481 +++

Warning: nagios-3.4.4-1.el6ost/nagios.upgradetov3.sh

Tempfile is created by using $$ should use mktemp instead.

tmp1=/tmp/nagioscfg.$$.tmp

--- Additional comment from Kurt Seifried on 2013-04-30 03:19:10 EDT ---

nagios.upgradetov3.sh is not in upstreams files, it's added by Red Hat and several other vendors. So splitting this bug again.

+++ This bug was initially created as a clone of Bug #957481 +++

Some potential issues discovered whilst auditing openstack & dependencies for tempfile vulnerabilities.

Warning: nagios-3.4.4-1.el6ost/nagios/html/rss-newsfeed.php

define('MAGPIECACHEDIR', '/tmp/magpiecache');

Magpie RSS cache dir is set to a fixed location in /tmp. The cached RSS content is then used to build html content that could be served to an end user.

Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the UsersController controller.

The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.

def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end

Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

The (1) power and (2) ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.

Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.

Jaroslav Henner (jhenner) reports:

When console-log is run often enough, it seems to be causing death of nova-compute.