Cross-Site Scripting in python-django-horizon
ID: | RHSA-2017:1598-01 |
Distribution: | Red Hat |
Plattformen: | Red Hat Enterprise Linux OpenStack Platform |
Datum: | Do, 29. Juni 2017, 00:10 |
Referenzen: | https://access.redhat.com/security/cve/CVE-2017-7400 |
Applikationen: | Django Horizon |
Originalnachricht |
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: python-django-horizon security, bug fix, and enhancement update Advisory ID: RHSA-2017:1598-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2017:1598 Issue date: 2017-06-28 CVE Names: CVE-2017-7400 ===================================================================== 1. Summary: An update for python-django-horizon is now available for Red Hat OpenStack Platform 10.0 (Newton). Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 10.0 - noarch 3. Description: OpenStack Dashboard (horizon) provides administrators and users with a graphical interface to access, provision, and automate cloud-based resources. The following packages have been upgraded to a later upstream version: python-django-horizon (10.0.3). (BZ#1432289, BZ#1454330) Security Fix(es): * A cross-site scripting flaw was discovered in the OpenStack dashboard (horizon) which allowed remote authenticated administrators to conduct XSS attacks using a crafted federation mapping rule. For this flaw to be exploited, federation mapping must be enabled in the dashboard. (CVE-2017-7400) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1408777 - Default admin user from default domain does not have Domains tab in Horizon Web Interface. 1414997 - modifying any quota in horizon triggers cinder to update gigabytes = null. Results in horizon error. 1427328 - System info tab in horiozon does not display correct version. 1432036 - Password revealing icon (eyeball) is in the wrong place 1432245 - Cannot create volume from image if cinder v1 service deleted 1432289 - Rebase python-django-horizon to 10.0.3 1439626 - CVE-2017-7400 python-django-horizon: XSS in federation mappings UI 1454330 - Rebase python-django-horizon to 9dda5a 6. Package List: Red Hat OpenStack Platform 10.0: Source: python-django-horizon-10.0.3-6.el7ost.src.rpm noarch: openstack-dashboard-10.0.3-6.el7ost.noarch.rpm openstack-dashboard-theme-10.0.3-6.el7ost.noarch.rpm python-django-horizon-10.0.3-6.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-7400 https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is |