LOW

GHSA-43cm-73px-5v4m

OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

상세

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / nova

최초 영향 버전: 0 수정 버전: 12.0.0a0

수정 pip install --upgrade 'nova>=12.0.0a0'

참고

https://nvd.nist.gov/vuln/detail/CVE-2013-4278 [ADVISORY]
https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9 [WEB]
https://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492 [WEB]
https://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495 [WEB]
https://bugs.launchpad.net/ossa/+bug/1212179 [WEB]
https://github.com/openstack/nova [PACKAGE]
http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html [WEB]
http://rhn.redhat.com/errata/RHSA-2013-1199.html [WEB]