Red Hat Security Advisory

RHSA-2015:0843

openstack-nova security, bug fix, and enhancement update

Released 2015-04-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-nova-2014.1.4-3.el7ost, openstack-nova-api-2014.1.4-3.el7ost, openstack-nova-cells-2014.1.4-3.el7ost +12

Fixes 3 records

TI-2015-00227 CVE-2015-0259 · GHSA-x8xr-rm9r-7mvf

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before…

LOW 25

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for acces…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.0107 Published 2015-04-01 Partial fix · 2014.1.4, 2014.2.3 CWE-345

TI-2014-03023 CVE-2014-3708 · GHSA-43hc-pwvx-pmfg

OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote…

LOW 24

OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02806 Published 2014-10-31 Partial fix · 2014.1.4, 2014.2.1 CWE-399

TI-2014-06852 CVE-2014-8333 · GHSA-g63p-mfcm-54c4

The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated…

LOW 23

The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02022 Published 2014-10-31 Partial fix · 12.0.0a0 CWE-399