Read the docs
TI-2014-07179 Aliases CVE-2014-8750GHSA-2pcw-fgm2-4xh2

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and…

Priority LOW 33CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.

Why it matters now

EPSS 0.02027 81st percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*2014.1 to before 2014.1.4VulnerableOpenStack
cpe:2.3:a:openstack:nova:2014.2:milestone1:*:*:*:*:*:*2014.2 milestone1VulnerableOpenStack
cpe:2.3:a:openstack:nova:2014.2:milestone2:*:*:*:*:*:*2014.2 milestone2VulnerableOpenStack
cpe:2.3:a:openstack:nova:2014.2:milestone3:*:*:*:*:*:*2014.2 milestone3VulnerableOpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions 2014.1 to before 2014.1.4 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:2014.2:milestone1:*:*:*:*:*:* Versions 2014.2 milestone1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:2014.2:milestone2:*:*:*:*:*:* Versions 2014.2 milestone2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:2014.2:milestone3:*:*:*:*:*:* Versions 2014.2 milestone3 Vulnerable ·OpenStack

Remediation

Red Hat 3 advisories

  • RHSA-2014:1781 Released 2014-11-03 · Red Hat rating Important
    openstack-nova security, bug fix, and enhancement update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-nova-2014.1.3-4.el6ost, openstack-nova-api-2014.1.3-4.el6ost, openstack-nova-cells-2014.1.3-4.el6ost +11
  • RHSA-2014:1782 Released 2014-11-03 · Red Hat rating Important
    openstack-nova security, bug fix, and enhancement update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-nova-2014.1.3-4.el7ost, openstack-nova-api-2014.1.3-4.el7ost, openstack-nova-cells-2014.1.3-4.el7ost +11
  • RHSA-2014:1689 Released 2014-10-22 · Red Hat rating Important
    openstack-nova security, bug fix, and enhancement update
    • Red Hat Enterprise Linux OpenStack Platform 4.0 openstack-nova-2013.2.4-2.el6ost, openstack-nova-api-2013.2.4-2.el6ost, openstack-nova-cells-2013.2.4-2.el6ost +11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 4.0Fixed RHSA-2014:1689
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2014:1781
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2014:1782

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-8750
  2. 2026-10-03 Alias added: GHSA-2pcw-fgm2-4xh2

References

Advisory 6

  • TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
  • TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
  • TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
  • TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences