Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS12cXA2LWo0NTItajZ3cM0wPA

Open Redirect in CPython that affects users of OpenStack Nova

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

Permalink: https://github.com/advisories/GHSA-vqp6-j452-j6wp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cXA2LWo0NTItajZ3cM0wPA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 12 months ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-vqp6-j452-j6wp, CVE-2021-3654
References: Blast Radius: 9.8

Affected Packages

pypi:nova
Dependent packages: 0
Dependent repositories: 40
Downloads: 3,670 last month
Affected Version Ranges: >= 23.0.0, < 23.0.3, >= 22.0.0, < 22.2.3, < 21.2.3
Fixed in: 23.0.3, 22.2.3, 21.2.3
All affected versions: 15.1.5, 16.1.6, 16.1.7, 16.1.8, 17.0.7, 17.0.8, 17.0.9, 17.0.10, 17.0.11, 17.0.12, 17.0.13, 18.0.2, 18.0.3, 18.1.0, 18.2.0, 18.2.1, 18.2.2, 18.2.3, 18.3.0, 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.2.0, 19.3.0, 19.3.1, 19.3.2, 20.0.0, 20.0.1, 20.1.0, 20.1.1, 20.2.0, 20.3.0, 20.4.0, 20.4.1, 20.5.0, 20.6.0, 20.6.1, 21.0.0, 21.1.0, 21.1.1, 21.1.2, 21.2.0, 21.2.1, 21.2.2, 22.0.0, 22.0.1, 22.1.0, 22.2.0, 22.2.1, 22.2.2, 23.0.0, 23.0.1, 23.0.2
All unaffected versions: 21.2.3, 21.2.4, 22.3.0, 22.4.0, 23.1.0, 23.2.0, 23.2.1, 23.2.2, 24.0.0, 24.1.0, 24.1.1, 24.2.0, 24.2.1, 25.0.0, 25.0.1, 25.1.0, 25.1.1, 25.2.0, 25.2.1, 25.3.0, 26.0.0, 26.1.0, 26.1.1, 26.2.0, 26.2.1, 26.2.2, 27.0.0, 27.1.0, 27.2.0, 28.0.0, 28.0.1, 29.0.0