CVE-2020-29565
Fixed in a distro release EPSS 1%
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
Products: openstack horizon, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | horizon | 15.3.2 |
| PyPI | horizon | 16.2.1 |
| PyPI | horizon | 18.3.3 |
| PyPI | horizon | 18.6.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | horizon | 3:14.0.2-3+deb10u2 |
| Debian 12 | horizon | 3:18.6.1-1 |
| Debian 13 | horizon | 3:18.6.1-1 |
| Debian 14 | horizon | 3:18.6.1-1 |
| Red Hat openstack 13 | openstack-dashboard | 1:13.0.3-7.el7ost |
| Red Hat openstack 13 | python-django-horizon | 1:13.0.3-7.el7ost |
| Red Hat openstack 16.1 | openstack-dashboard | 1:16.2.1-1.20201114033610.el8ost |
| Red Hat openstack 16.1 | python-django-horizon | 1:16.2.1-1.20201114033610.el8ost |
| Red Hat openstack 16.1 | python3-django-horizon | 1:16.2.1-1.20201114033610.el8ost |
| SUSE HPE Helion OpenStack 8 | openstack-dashboard | 12.0.5~dev6-3.29.1 |
| SUSE HPE Helion OpenStack 8 | release-notes-hpe-helion-openstack | 8.20201214-3.26.1 |
| SUSE OpenStack Cloud 8 | openstack-dashboard | 12.0.5~dev6-3.29.1 |
| SUSE OpenStack Cloud 8 | release-notes-suse-openstack-cloud | 8.20201214-3.26.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-dashboard | 12.0.5~dev6-3.29.1 |
| SUSE OpenStack Cloud Crowbar 8 | release-notes-suse-openstack-cloud | 8.20201214-3.26.1 |
| Ubuntu 16.04 LTS | horizon | 2:9.1.2-0ubuntu5.2 |
| Ubuntu 18.04 LTS | horizon | 3:13.0.3-0ubuntu2 |
| Ubuntu 20.04 LTS | horizon | 3:18.3.2-0ubuntu0.20.04.4 |