OpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonce#openstack
Critical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitOpenStack Glance SSRF flaws expose internal URLs and image data
Three related bugs let authenticated users reach cloud metadata and turn blind SSRF into full-read exfiltration via web-download and HTTP image APIs.
By tarpitCeph auth flaws force keyring rotation across OpenStack
Four CephX CVEs fixed in Ceph 19.2.6 and 20.2.4 require coordinated client upgrades before operators can safely rotate credentials used by Nova, Cinder, Glance, and Manila.
By tarpitOpenStack Designate bugs allow cross-tenant DNS zone collisions
Two flaws in multi-pool setups let tenants overlap other tenants' zones, enabling hijacks and a deterministic mDNS denial of service.
By tarpitOpenStack Ironic Python Agent allows root command execution via NTP config
Unsanitized ntp_server values let project managers run arbitrary commands during ramdisk startup.
By tarpit