PYSEC-2012-39
Withdrawn 2024-11-22. This finding no longer applies and is kept for reference. It is not used when checking packages.
Quick fix
PYSEC-2012-39 — nova: upgrade to the fixed version with the command below.
pip install --upgrade 'nova>=b0feaffdb2b1c51182b8dce41b367f3449af5dd9'Details
virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/nova
Introduced in:
0Fixed in: b0feaffdb2b1c51182b8dce41b367f3449af5dd9Fix
pip install --upgrade 'nova>=b0feaffdb2b1c51182b8dce41b367f3449af5dd9'References
- http://secunia.com/advisories/49802[ADVISORY]
- https://review.openstack.org/#/c/9268/[WEB]
- https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9[EVIDENCE]
- https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9[FIX]
- https://bugs.launchpad.net/nova/+bug/1015531[WEB]
- https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7[EVIDENCE]
- https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7[FIX]
- http://www.securityfocus.com/bid/54278[WEB]
- http://www.ubuntu.com/usn/USN-1497-1[ADVISORY]
- http://secunia.com/advisories/49763[ADVISORY]
- https://lists.launchpad.net/openstack/msg14089.html[WEB]
- http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html[WEB]
- http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html[WEB]
- https://github.com/advisories/GHSA-cm54-3vvf-f5p8[ADVISORY]