LOW

GHSA-43cm-73px-5v4m

OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

Details

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / nova

Introduced in: 0 Fixed in: 12.0.0a0

Fix pip install --upgrade 'nova>=12.0.0a0'

References

https://nvd.nist.gov/vuln/detail/CVE-2013-4278 [ADVISORY]
https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9 [WEB]
https://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492 [WEB]
https://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495 [WEB]
https://bugs.launchpad.net/ossa/+bug/1212179 [WEB]
https://github.com/openstack/nova [PACKAGE]
http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html [WEB]
http://rhn.redhat.com/errata/RHSA-2013-1199.html [WEB]