Openstack nova: vnc proxy can connect to the wrong vm
Priority LOW 37CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
Why it matters now
EPSS 0.0214 82nd percentileScored 2026-11-07
Fix Fixed Nova (PyPI): 12.0.0a0Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | OpenStack Folsom for RHEL 6 | — | 2012.2.3-7.el6ost | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | Not affected | CNA |
| — | Nova (PyPI) | before 12.0.0a0 | 12.0.0a0 | Patch available | GHSA-qfp8-hfqx-c79c |
- OpenStack Folsom for RHEL 6 VendorRed Hat Affected — Fixed in 2012.2.3-7.el6ost Patch available CNA
- Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — Not affected CNA
- Nova (PyPI) Vendor— Affected before 12.0.0a0 Fixed in 12.0.0a0 Patch available GHSA-qfp8-hfqx-c79c
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* | 2012.1 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* | 2012.2 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:grizzly:2012.2:*:*:*:*:*:*:* | 2012.2 | Vulnerable | OpenStack |
| cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* | 11.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
- cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* Versions 2012.1 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* Versions 2012.2 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:grizzly:2012.2:*:*:*:*:*:*:* Versions 2012.2 Vulnerable ·OpenStack
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* Versions 11.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
Remediation
- Fix · GHSA-qfp8-hfqx-c79c Nova (PyPI) Fixed in 12.0.0a0 Advisory →
Red Hat 1 advisory
- RHSA-2013:0709 Released 2013-04-04 · Red Hat rating Moderateopenstack-nova security and bug fix update
- OpenStack Folsom openstack-nova-2012.2.3-7.el6ost, openstack-nova-api-2012.2.3-7.el6ost, openstack-nova-cert-2012.2.3-7.el6ost +9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenStack Folsom | Fixed | RHSA-2013:0709 |
Not affected: 4 products
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
Timeline
- 2026-10-02 Threatist record created from CVE-2013-0335
- 2026-10-03 Alias added: GHSA-qfp8-hfqx-c79c
References
Other 19
- http://rhn.redhat.com/errata/RHSA-2013-0709.html
- http://www.openwall.com/lists/oss-security/2013/02/26/7
- http://www.osvdb.org/90657
- http://www.ubuntu.com/usn/USN-1771-1
- https://access.redhat.com/security/cve/CVE-2013-0335
- https://bugs.launchpad.net/nova/+bug/1125378
- https://github.com/advisories/GHSA-qfp8-hfqx-c79c
- https://review.openstack.org/#/c/22086/
- https://review.openstack.org/#/c/22758
- https://review.openstack.org/#/c/22872/
- https://github.com/openstack/nova
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-43.yaml
- https://review.openstack.org/#/c/22086
- https://review.openstack.org/#/c/22872
- http://github.com/openstack/nova/commit/05a3374992bc8ba53ddc9c491b51c4b59eed0a72
- http://github.com/openstack/nova/commit/3b0f4cf6bea33e6ee1893f6e872d968b0c309f88
- http://github.com/openstack/nova/commit/48e81f1554ce41c3d4f7445421d19f4a8128e98d
- http://github.com/openstack/nova/commit/ad94a90202193335f011888db017e557b07faf8a
- http://github.com/openstack/nova/commit/e98928cf77645fdc309da894f3bd332e99482e0d
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2013-0335 · CVE Program
- CVE-2013-0335 · NVD
- FIRST EPSS
- GHSA-qfp8-hfqx-c79c · GitHub Advisory Database · CC BY 4.0
- CVE-2013-0335 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences