Mirantis Technical Bulletins

09 December 2021

• A critical severity vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j 2 utility was disclosed publicly via the project’s GitHub on December 9, 2021

05 June 2020

• SaltStack authentication bypass and directory traversal vulnerabilities (CVE-2020-11651, CVE-2020-11652)

06 February 2020

• Enabling basic auth for Prometheus and Alertmanager

11 December 2019

• TSX Asynchronous Abort vulnerability in Intel processors, Intel® processor machine check error vulnerability, and i915 graphic driver flaw

25 November 2019

• Open vSwitch daemon memory leak

03 September 2019

• DVR edge router: accidental centralized floating IP removal

29 July 2019

• SACK Panic and Other TCP Denial of Service Issues

3 April 2019

• Specific traffic packets with corrupted checksums may result in a kernel panic on a compute node

6 March 2019

• Add osd blacklist to the default mon permissions in Ceph

7 February 2019

• Removing of the vRouter kernel module results in a compute node deadlock

29 January 2019

• l2_pop flows missing when spawning VMs at a high rate

24 January 2019

• The default connection limit for HAProxy is too small for large MCP clusters

5 November 2018

• Large number of Ceph volumes causes Cinder service instability

24 April 2018

• VNC consoles of virtual machines are accessible from any network

25 January 2018

• Processor Side-Channel Attacks

12 January 2018

• Kernel Side-Channel Attacks

22 December 2016

• Deployments fail due to attempts to start services using systemctl

31 October 2016

• Linux Kernel Local Privilege Escalation (CVE-2016-5195)

14 October 2016

• MySQL Remote Root Code Execution / Privilege Escalation (CVE-2016-6662)

29 September 2016

• Galera gcomm failure and MySQL split-brain after MySQL restart

20 September 2016

• Segmentation fault occurs when running Ubuntu Xenial-based guest images

23 June 2016

• Murano is vulnerable to a remote code execution attack

29 March 2016

• S3 API/Keystone integration in Ceph RADOS Gateway

16 March 2016

• DROWN: Crossprotocol attack on TLS using SSLv2 CVE-2016-0800

7 March 2016

• Multiple stack-based buffer overflows in the GNU C library

17 December 2015

• iSCSI target daemon is accessible from public network.

17 December 2015

• epmd is accessible from public network.

27 October 2015

• Image direct URLs​ in Glance backed by Swift contain admin credentials.

27 October 2015

• Libvirt API is accessible from external and tenant networks.

13 August 2015

• QEMU vulnerability (heap overflow).

30 June 2015

• Potential data loss when upgrading Mirantis OpenStack Fuel master node to 6.1 from 6.0 or earlier versions.

22 June 2015

• Leap second.

13 May 2015

• QEMU Vulnerability (VENOM).

20 March 2015

• OpenSSL vulnerabilities.

20 March 2015

• Linux kernel security vulnerabilities.

19 March 2015

• Nova console Cross-Site WebSocket hijacking vulnerability (CVE-2015-0259).

19 March 2015

• Linux kernel security vulnerabilities.

18 March 2015

• Slow network performance with OVS bonds (UPDATE).

10 March 2015

• Removing Ceph OSD node via Fuel may lead to data loss in Ceph cluster.

5 February 2015

• Slow network performance with OVS bonds.

3 February 2015

• Broken Mirantis OpenStack 6.0 image file.

28 January 2015

• A buffer overflow in the __nss_hostname_digits_dots() function of the GNU C Library potentially may lead to remote code execution (CVE-2015-0235).

17 December 2014

• Virtual Machines fail to receive an IP address due to instability in DHCP agent.

17 December 2014

• Virtual Machines fail to start due to slow processing of IP tables rules.

1 October 2014

• GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which may allow remote attackers to execute arbitrary code.

10 September 2014

• AMQP heartbeat enabled to detect hung RabbitMQ sessions.

29 April 2014

• GNU C Library Vulnerabilities (Ubuntu); Mirantis recommends applying these patches.

11 April 2014

• Information about the OpenSSL ‘Heartbleed’ vulnerability.