Red Hat Security Advisory

RHSA-2014:1084

openstack-nova security, bug fix, and enhancement update

Released 2014-08-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 4.0 openstack-nova-2013.2.3-12.el6ost, openstack-nova-api-2013.2.3-12.el6ost, openstack-nova-cells-2013.2.3-12.el6ost +11

Fixes 2 records

TI-2014-00161 CVE-2014-0167 · GHSA-p258-xmh3-72pv

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before…

LOW 30

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and othe…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01655 Published 2014-04-15 Partial fix · 2013.2.4 CWE-264

TI-2014-02843 CVE-2014-3517 · GHSA-xjmj-p278-4jp5

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before…

LOW 24

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01954 Published 2014-08-07 Partial fix · 2013.2.4, 2014.1.2 CWE-200