GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2015:2064-1

Vulnerability from csaf_suse - Published: 2015-11-20 13:11 - Updated: 2015-11-20 13:11
Summary
Security update for openstack-dashboard
Severity
Moderate
Notes
Title of the patch: Security update for openstack-dashboard
Description of the patch: This update provides fixes and enhancements for openstack-dashboard, crowbar-barclamp-nova_dashboard and python-django_openstack_auth. openstack-dashboard: - Reset flavors for other than 'Boot from Image' source type. (bsc#945515) - Add deactivated status for glance image. - Fix TemplateSyntaxError at hypervisors view. - Fix addition of plugin panel to panel group. - Remove admin role name 'admin' hardcode. (bsc#935442) - Escape the description param from heat template. (bsc#933722, CVE-2015-3219) - Enhance policy rules to workflow actions and identity project. - Sanitation of metadata passed from Django to avoid persistent XSS. (bsc#931437, CVE-2015-3988) - Fix Terminate Instance on network topology page. - Show ports from shared nets in floating IP assoc. - Fix incorrect ca arguments for calling ceilometer client. - Fix dynamic select layout when help block is displayed. - Pass correct project ID to get tenant_usages. (bsc#928891) crowbar-barclamp-nova_dashboard: - Allow switching on multidomain support. (bsc#945052) - Fix quoting of supported_provider_types. (bsc#936368) - Enable the POLICY_FILES setting configuration. - Fix attribute being fetched from wrong node. (bsc#936059) python-django_openstack_auth: - Remove admin role name 'admin' hardcode in User.is_superuser().
Patchnames: sleclo50sp3-openstack-crowbar-dashboard-201510-12220
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2015-3219
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE OpenStack Cloud 5:crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch —
Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 5:openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64 —
Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 5:python-django_openstack_auth-1.1.7-11.3.x86_64 —
Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 5:python-horizon-2014.2.4~a0~dev12-13.2.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2015-3988
Affected products
Recommended 4 products, the same list as for CVE-2015-3219
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for openstack-dashboard",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update provides fixes and enhancements for openstack-dashboard,\ncrowbar-barclamp-nova_dashboard and python-django_openstack_auth.\n\nopenstack-dashboard:\n\n- Reset flavors for other than \u0027Boot from Image\u0027 source type. (bsc#945515)\n- Add deactivated status for glance image.\n- Fix TemplateSyntaxError at hypervisors view.\n- Fix addition of plugin panel to panel group.\n- Remove admin role name \u0027admin\u0027 hardcode. (bsc#935442)\n- Escape the description param from heat template. (bsc#933722, CVE-2015-3219)\n- Enhance policy rules to workflow actions and identity project.\n- Sanitation of metadata passed from Django to avoid persistent XSS. (bsc#931437, CVE-2015-3988)\n- Fix Terminate Instance on network topology page.\n- Show ports from shared nets in floating IP assoc.\n- Fix incorrect ca arguments for calling ceilometer client.\n- Fix dynamic select layout when help block is displayed.\n- Pass correct project ID to get tenant_usages. (bsc#928891)\n\ncrowbar-barclamp-nova_dashboard:\n\n- Allow switching on multidomain support. (bsc#945052)\n- Fix quoting of supported_provider_types. (bsc#936368)\n- Enable the POLICY_FILES setting configuration.\n- Fix attribute being fetched from wrong node. (bsc#936059)\n\npython-django_openstack_auth:\n\n- Remove admin role name \u0027admin\u0027 hardcode in User.is_superuser().\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "sleclo50sp3-openstack-crowbar-dashboard-201510-12220",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_2064-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2015:2064-1",
        "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20152064-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2015:2064-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2015-November/001689.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 928891",
        "url": "https://bugzilla.suse.com/928891"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 931437",
        "url": "https://bugzilla.suse.com/931437"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 933607",
        "url": "https://bugzilla.suse.com/933607"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 933722",
        "url": "https://bugzilla.suse.com/933722"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 935442",
        "url": "https://bugzilla.suse.com/935442"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 936059",
        "url": "https://bugzilla.suse.com/936059"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 936368",
        "url": "https://bugzilla.suse.com/936368"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 945052",
        "url": "https://bugzilla.suse.com/945052"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 945515",
        "url": "https://bugzilla.suse.com/945515"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-3219 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-3219/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-3988 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-3988/"
      }
    ],
    "title": "Security update for openstack-dashboard",
    "tracking": {
      "current_release_date": "2015-11-20T13:11:32Z",
      "generator": {
        "date": "2015-11-20T13:11:32Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2015:2064-1",
      "initial_release_date": "2015-11-20T13:11:32Z",
      "revision_history": [
        {
          "date": "2015-11-20T13:11:32Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
                "product": {
                  "name": "crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
                  "product_id": "crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
                "product": {
                  "name": "openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
                  "product_id": "openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python-django_openstack_auth-1.1.7-11.3.x86_64",
                "product": {
                  "name": "python-django_openstack_auth-1.1.7-11.3.x86_64",
                  "product_id": "python-django_openstack_auth-1.1.7-11.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python-horizon-2014.2.4~a0~dev12-13.2.x86_64",
                "product": {
                  "name": "python-horizon-2014.2.4~a0~dev12-13.2.x86_64",
                  "product_id": "python-horizon-2014.2.4~a0~dev12-13.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 5",
                "product": {
                  "name": "SUSE OpenStack Cloud 5",
                  "product_id": "SUSE OpenStack Cloud 5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:cloud:5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch as component of SUSE OpenStack Cloud 5",
          "product_id": "SUSE OpenStack Cloud 5:crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch"
        },
        "product_reference": "crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64 as component of SUSE OpenStack Cloud 5",
          "product_id": "SUSE OpenStack Cloud 5:openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64"
        },
        "product_reference": "openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-django_openstack_auth-1.1.7-11.3.x86_64 as component of SUSE OpenStack Cloud 5",
          "product_id": "SUSE OpenStack Cloud 5:python-django_openstack_auth-1.1.7-11.3.x86_64"
        },
        "product_reference": "python-django_openstack_auth-1.1.7-11.3.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-horizon-2014.2.4~a0~dev12-13.2.x86_64 as component of SUSE OpenStack Cloud 5",
          "product_id": "SUSE OpenStack Cloud 5:python-horizon-2014.2.4~a0~dev12-13.2.x86_64"
        },
        "product_reference": "python-horizon-2014.2.4~a0~dev12-13.2.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3219",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-3219"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE OpenStack Cloud 5:crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
          "SUSE OpenStack Cloud 5:openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
          "SUSE OpenStack Cloud 5:python-django_openstack_auth-1.1.7-11.3.x86_64",
          "SUSE OpenStack Cloud 5:python-horizon-2014.2.4~a0~dev12-13.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-3219",
          "url": "https://www.suse.com/security/cve/CVE-2015-3219"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 933722 for CVE-2015-3219",
          "url": "https://bugzilla.suse.com/933722"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE OpenStack Cloud 5:crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
            "SUSE OpenStack Cloud 5:openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
            "SUSE OpenStack Cloud 5:python-django_openstack_auth-1.1.7-11.3.x86_64",
            "SUSE OpenStack Cloud 5:python-horizon-2014.2.4~a0~dev12-13.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-11-20T13:11:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-3219"
    },
    {
      "cve": "CVE-2015-3988",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-3988"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE OpenStack Cloud 5:crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
          "SUSE OpenStack Cloud 5:openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
          "SUSE OpenStack Cloud 5:python-django_openstack_auth-1.1.7-11.3.x86_64",
          "SUSE OpenStack Cloud 5:python-horizon-2014.2.4~a0~dev12-13.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-3988",
          "url": "https://www.suse.com/security/cve/CVE-2015-3988"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 931437 for CVE-2015-3988",
          "url": "https://bugzilla.suse.com/931437"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE OpenStack Cloud 5:crowbar-barclamp-nova_dashboard-1.9+git.1443622531.b2b2939-9.3.noarch",
            "SUSE OpenStack Cloud 5:openstack-dashboard-2014.2.4~a0~dev12-13.2.x86_64",
            "SUSE OpenStack Cloud 5:python-django_openstack_auth-1.1.7-11.3.x86_64",
            "SUSE OpenStack Cloud 5:python-horizon-2014.2.4~a0~dev12-13.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-11-20T13:11:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-3988"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.