—

PYSEC-2017-21

Quick fix

PYSEC-2017-21 — nova-lxd: upgrade to the fixed version with the command below.

pip install --upgrade 'nova-lxd>=1b76cefb92081efa1e88cd8f330253f857028bd2'

Details

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/nova-lxd

Introduced in: 0Fixed in: 1b76cefb92081efa1e88cd8f330253f857028bd2

Fixpip install --upgrade 'nova-lxd>=1b76cefb92081efa1e88cd8f330253f857028bd2'

References

https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2[FIX]
https://bugs.launchpad.net/nova-lxd/+bug/1656847[WEB]
http://www.ubuntu.com/usn/USN-3195-1[ADVISORY]
http://www.securityfocus.com/bid/96182[WEB]
http://www.openwall.com/lists/oss-security/2017/02/09/3[WEB]
https://github.com/advisories/GHSA-6xc7-4cx8-j3xc[ADVISORY]