Ubuntu: 2062-1: OpenStack Horizon vulnerability
Posted by Benjamin D. Thomas   
Ubuntu Horizon could be made to expose sensitive information over the network.
Ubuntu Security Notice USN-2062-1
December 20, 2013

horizon vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10


Horizon could be made to expose sensitive information over the network.

Software Description:
- horizon: Web interface for OpenStack cloud infrastructure


Chris Chapman discovered cross-site scripting (XSS) vulnerabilities
in Horizon via the Volumes and Network Topology pages. An authenticated
attacker could exploit these to conduct stored cross-site scripting (XSS)
attacks against users viewing these pages in order to modify the contents
or steal confidential data within the same domain.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  python-django-horizon           1:2013.2-0ubuntu1.1

Ubuntu 13.04:
  python-django-horizon           1:2013.1.4-0ubuntu1.1

Ubuntu 12.10:
  python-django-horizon           2012.2.4-0ubuntu1.1

In general, a standard system update will make all the necessary changes.


Package Information: