The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly…
Priority LOW 13CWE-264Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Security bypass, Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264 and CWE-770.
Summary
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
Why it matters now
EPSS 0.00705 53rd percentileScored 2026-11-07
Fix Partial nova (PyPI): 12.0.0a0Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nova (PyPI) | before 12.0.0a0 | 12.0.0a0 | Patch available | GHSA-jv34-xvjq-ppch |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nova (PyPI) Vendor— Affected before 12.0.0a0 Fixed in 12.0.0a0 Patch available GHSA-jv34-xvjq-ppch
Remediation
- Fix · GHSA-jv34-xvjq-ppch nova (PyPI) Fixed in 12.0.0a0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 4 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
Timeline
- 2026-10-02 Threatist record created from CVE-2014-2573
- 2026-10-03 Alias added: GHSA-jv34-xvjq-ppch
References
Other 7
- [oss-security] 20140321 Re: CVE request for vulnerability in OpenStack Nova
- https://bugs.launchpad.net/nova/+bug/1269418
- [oss-security] 20140321 CVE request for vulnerability in OpenStack Nova
- https://github.com/openstack/nova/commit/b3cc3f62a60662e5bb82136c0cfa464592a6afe9
- https://github.com/openstack/nova/commit/efb66531bc37ee416778a70d46c657608ca767af
- https://github.com/openstack/nova
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-113.yaml
More OpenStack Compute vulnerabilities
- TI-2013-05849 The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver… CVSS 2.0HIGH 7.1
- TI-2014-00161 The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before… CVSS 2.0MEDIUM 6.0
- TI-2013-02015 Improper certificate validation in OpenStack Keystone CVSS 3.1MEDIUM 5.9
- TI-2013-03652 The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before… CVSS 2.0MEDIUM 4.3
- TI-2012-02292 The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1)… CVSS 2.0MEDIUM 4.3
- TI-2013-03658 Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and… CVSS 2.0MEDIUM 4.0
Sources
- CVE-2014-2573 · CVE Program
- CVE-2014-2573 · NVD
- FIRST EPSS
- GHSA-jv34-xvjq-ppch · GitHub Advisory Database · CC BY 4.0
- CVE-2014-2573 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences