Mirantis Technical Bulletins

This page contains links to Mirantis Technical Bulletins. Here you will find information about security and critical flaws, most often with resolutions, that affect Mirantis products and services. Security and critical issue advisories will also be proactively e-mailed to those customers with active service contracts.

---

09 December 2021

• A critical severity vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j 2 utility was disclosed publicly via the project’s GitHub on December 9, 2021

05 June 2020

• SaltStack authentication bypass and directory traversal vulnerabilities (CVE-2020-11651, CVE-2020-11652)

06 February 2020

• Enabling basic auth for Prometheus and Alertmanager

11 December 2019

• TSX Asynchronous Abort vulnerability in Intel processors, Intel® processor machine check error vulnerability, and i915 graphic driver flaw

25 November 2019

• Open vSwitch daemon memory leak

03 September 2019

• DVR edge router: accidental centralized floating IP removal

29 July 2019

• SACK Panic and Other TCP Denial of Service Issues

3 April 2019

• Specific traffic packets with corrupted checksums may result in a kernel panic on a compute node

6 March 2019

• Add osd blacklist to the default mon permissions in Ceph

7 February 2019

• Removing of the vRouter kernel module results in a compute node deadlock

29 January 2019

• l2_pop flows missing when spawning VMs at a high rate

24 January 2019

• The default connection limit for HAProxy is too small for large MCP clusters

5 November 2018

• Large number of Ceph volumes causes Cinder service instability

24 April 2018

• VNC consoles of virtual machines are accessible from any network

25 January 2018

• Processor Side-Channel Attacks

12 January 2018

• Kernel Side-Channel Attacks

22 December 2016

• Deployments fail due to attempts to start services using systemctl

31 October 2016

• Linux Kernel Local Privilege Escalation (CVE-2016-5195)

14 October 2016

• MySQL Remote Root Code Execution / Privilege Escalation (CVE-2016-6662)

29 September 2016

• Galera gcomm failure and MySQL split-brain after MySQL restart

20 September 2016

• Segmentation fault occurs when running Ubuntu Xenial-based guest images

23 June 2016

• Murano is vulnerable to a remote code execution attack

29 March 2016

• S3 API/Keystone integration in Ceph RADOS Gateway

16 March 2016

• DROWN: Crossprotocol attack on TLS using SSLv2 CVE-2016-0800

7 March 2016

• Multiple stack-based buffer overflows in the GNU C library

17 December 2015

• iSCSI target daemon is accessible from public network.

17 December 2015

• epmd is accessible from public network.

27 October 2015

• Image direct URLs​ in Glance backed by Swift contain admin credentials.

27 October 2015

• Libvirt API is accessible from external and tenant networks.

13 August 2015

• QEMU vulnerability (heap overflow).

30 June 2015

• Potential data loss when upgrading Mirantis OpenStack Fuel master node to 6.1 from 6.0 or earlier versions.

22 June 2015

• Leap second.

13 May 2015

• QEMU Vulnerability (VENOM).

20 March 2015

• OpenSSL vulnerabilities.

20 March 2015

• Linux kernel security vulnerabilities.

19 March 2015

• Nova console Cross-Site WebSocket hijacking vulnerability (CVE-2015-0259).

19 March 2015

• Linux kernel security vulnerabilities.

18 March 2015

• Slow network performance with OVS bonds (UPDATE).

10 March 2015

• Removing Ceph OSD node via Fuel may lead to data loss in Ceph cluster.

5 February 2015

• Slow network performance with OVS bonds.

3 February 2015

• Broken Mirantis OpenStack 6.0 image file.

28 January 2015

• A buffer overflow in the __nss_hostname_digits_dots() function of the GNU C Library potentially may lead to remote code execution (CVE-2015-0235).

17 December 2014

• Virtual Machines fail to receive an IP address due to instability in DHCP agent.

17 December 2014

• Virtual Machines fail to start due to slow processing of IP tables rules.

1 October 2014

• GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which may allow remote attackers to execute arbitrary code.

10 September 2014

• AMQP heartbeat enabled to detect hung RabbitMQ sessions.

29 April 2014

• GNU C Library Vulnerabilities (Ubuntu); Mirantis recommends applying these patches.

11 April 2014

• Information about the OpenSSL ‘Heartbleed’ vulnerability.